CVE-2026-8164

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8164", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2026-05-08T11:29:48.099Z", "datePublished": "2026-07-28T14:01:02.028Z", "dateUpdated": "2026-07-28T14:45:32.059Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-07-28T14:01:02.028Z"}, "title": "Search Order Hijacking in ArkSigner's ArkSigner Desktop Client", "datePublic": "2026-07-28T13:38:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-427", "description": "CWE-427 Uncontrolled Search Path Element", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-471", "descriptions": [{"lang": "en", "value": "CAPEC-471 Search Order Hijacking"}]}], "affected": [{"vendor": "ArkSigner Software and Hardware Industry and Trade Inc.", "product": "ArkSigner Desktop Client", "versions": [{"status": "affected", "version": "v2.2.16.10", "lessThanOrEqual": "17062026", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijacking.\n\nThis issue affects ArkSigner Desktop Client: from v2.2.16.10 through 17062026.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijacking.<p>This issue affects ArkSigner Desktop Client: from v2.2.16.10 through 17062026.</p>"}]}], "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0665", "tags": ["government-resource"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Alperen KESK\u0130N", "type": "finder"}], "source": {"defect": ["TR-26-0665"], "advisory": "TR-26-0665", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-28T14:44:57.907759Z", "id": "CVE-2026-8164", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T14:45:32.059Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8164", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2026-05-08T11:29:48.099Z", "datePublished": "2026-07-28T14:01:02.028Z", "dateUpdated": "2026-07-28T14:45:32.059Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-07-28T14:01:02.028Z"}, "title": "Search Order Hijacking in ArkSigner's ArkSigner Desktop Client", "datePublic": "2026-07-28T13:38:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-427", "description": "CWE-427 Uncontrolled Search Path Element", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-471", "descriptions": [{"lang": "en", "value": "CAPEC-471 Search Order Hijacking"}]}], "affected": [{"vendor": "ArkSigner Software and Hardware Industry and Trade Inc.", "product": "ArkSigner Desktop Client", "versions": [{"status": "affected", "version": "v2.2.16.10", "lessThanOrEqual": "17062026", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijacking.\n\nThis issue affects ArkSigner Desktop Client: from v2.2.16.10 through 17062026.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijacking.<p>This issue affects ArkSigner Desktop Client: from v2.2.16.10 through 17062026.</p>"}]}], "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0665", "tags": ["government-resource"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Alperen KESK\u0130N", "type": "finder"}], "source": {"defect": ["TR-26-0665"], "advisory": "TR-26-0665", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-8164", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-28T14:44:57.907759Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T14:45:24.991Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ArkSigner Desktop Client", "vendor": "ArkSigner Software and Hardware Industry and Trade Inc.", "versions": [{"lessThanOrEqual": "17062026", "status": "affected", "version": "v2.2.16.10", "versionType": "custom"}]}], "source": "iletisim@usom.gov.tr"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijacking.\n\nThis issue affects ArkSigner Desktop Client: from v2.2.16.10 through 17062026."}, {"lang": "es", "value": "Una vulnerabilidad de Elemento de Ruta de B\u00fasqueda No Controlado en ArkSigner Software and Hardware Industry and Trade Inc. Cliente de escritorio ArkSigner permite el Secuestro del Orden de B\u00fasqueda.\n\nEste problema afecta al Cliente de escritorio ArkSigner: desde la v2.2.16.10 hasta la 17062026."}], "id": "CVE-2026-8164", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "iletisim@usom.gov.tr", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8164", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-28T14:44:57.907759Z", "version": "2.0.3"}}]}, "published": "2026-07-28T15:17:51.633", "references": [{"source": "iletisim@usom.gov.tr", "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0665"}], "sourceIdentifier": "iletisim@usom.gov.tr", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "iletisim@usom.gov.tr", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[v2.2.16.10,17062026]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "ArkSigner Desktop Client", "source": "cna", "vendor": "ArkSigner Software and Hardware Industry and Trade Inc."}, "product": "arksigner_desktop_client", "vendor": "arksigner"}], "created": "2026-07-28T20:34:31.947038+00:00", "updated": "2026-08-03T15:00:15.941507+00:00", "vendors": ["arksigner", "arksigner$PRODUCT$arksigner_desktop_client"]}