CVE-2026-16287CWE-78command-injection

CVE-2026-16287

High · published July 23, 2026

CVSS v3.1
7.8
EPSS
1%
Percentile
57.5
In the wild
Unconfirmed
What it is

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-update allows OS Command Injection.

This issue affects pardus-update: from 0.6.6 before 0.7.0.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00842 · 57.5th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-07-23T13:16Z
References (1)
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0609 · [email protected]
EPSS history
Timeline
  • 23 JUL 07:44Z
    Root Command Injection via Offline Update in TÜBİTAK BİLGEM's pardus-update
    cvelistv5