CVE-2026-8303 is a high severity (CVSS 7.8) incorrect privilege assignment flaw in TUBITAK BILGEM's Pardus-software before 1.0.5. A local user with low privileges can escalate their rights on the machine. The record's fix is to update Pardus-software to 1.0.5 or later.
What's affected
The record lists Pardus-software, a product of TUBITAK BILGEM's Software Technologies Research Institute, in every version before 1.0.5. It says the flaw is an incorrect privilege assignment and that it allows privilege escalation. The CVSS vector marks it as local, low complexity, low privileges required and no user interaction, with high impact on confidentiality, integrity and availability.
The advisory comes from the Turkish national cyber security authority, listed as notice TR-26-1080. The page did not load in readable form when I fetched it, so I rely on the record's text for the version and description. I found no second source on severity, and no version other than 1.0.5 is named.
The record does not describe the mechanism. That limits what can be said about it here, and I will not guess at how it works.
How to check if you're exposed
On a Pardus system, ask the package manager for the installed version:
apt policy pardus-software
dpkg -l | grep -i pardus-software
If the version is below 1.0.5, it is in scope. For a fleet, query each machine or use whatever inventory tool you already run. The weakness is local, so the machines most at risk are shared systems and workstations where several people or service accounts can log in. A single user laptop is less exposed than a lab or a kiosk, though a low privilege foothold from another bug can still be combined with it.
What to do now
- Update Pardus-software to 1.0.5 or later through the distribution's package channel.
- Prioritize multi-user machines, labs and shared workstations first.
- Review local accounts on affected machines and remove those that are not needed.
- Check the Turkish national authority notice TR-26-1080 for any extra steps, since the page could not be read when I fetched it.
- Record the update in your inventory so you can show which machines are fixed.
Why it matters
Incorrect privilege assignment, tracked as CWE-266, means software gives a user or process more rights than it should. A package manager front end is a sensitive place for that error, since software installation normally runs with administrator rights. A local escalation gives an attacker who already has a foothold, for example through a stolen low privilege account, a path to full control of the machine.
The score of 7.8 reflects the lack of any need for user interaction and the high impact once an account is escalated. The record does not list this CVE as exploited in the wild. For most organizations the remedy is a routine package update, which is the best reason to do it quickly.
Quick check
Can a remote attacker use this directly?
No. The vector is local, so the attacker needs an account or code execution on the machine first.
What is the fixed version?
The record says the issue affects versions before 1.0.5, which points to 1.0.5. Confirm with the national notice.
Sources
Last reviewed: 18 October 2026.
