Which versions of Pandora FMS are affected by CVE-2026-30805?

Pandora FMS versions 777-800 contain a critical authentication bypass vulnerability (CVSS 9.1) that allows unauthenticated remote attackers to access the API and modify system data by exploiting…

How to fix or mitigate CVE-2026-30805?

Within 24 hours: Inventory all Pandora FMS deployments and identify systems running versions 777-800; isolate or restrict network access to affected instances pending remediation. Within 7 days: Contact Pandora FMS vendor for patch availability timeline and interim guidance; implement network segmentation to limit API access to trusted sources only. Within 30 days: Apply vendor-released patch to all affected instances once available; conduct post-remediation audit of API access logs to detect prior unauthorized access.

Pandora FMS CVE-2026-30805

Q: What is the CVSS score of CVE-2026-30805?

CVE-2026-30805 has a CVSS 4.0 base score of 9.1 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:C/RE:M/U:Amber. EPSS exploitation probability: 0.0%.

EUVD-2026-29494 CRITICAL

Initialization of a Resource with an Insecure Default (CWE-1188)

2026-05-12 PandoraFMS

GHSA-m2m9-vhw3-w774

Authentication Bypass Pandora Fms

9.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:C/RE:M/U:Amber

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 16:32 vuln.today

CVSS changed

May 12, 2026 - 16:22 NVD

9.1 (CRITICAL)

CVE Published

May 12, 2026 - 15:09 nvd

CRITICAL 9.1

DescriptionCVE.org

Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access. This issue affects Pandora FMS: from 777 through 800

AnalysisAI

Authentication bypass in Pandora FMS versions 777-800 allows remote attackers to gain unauthorized API access via insecure default resource initialization. The vulnerability stems from CWE-1188 (default credentials or configuration), enabling attackers to bypass authentication mechanisms and access the API with high confidentiality and integrity impact. CVSS 4.0 scores this at 9.1 CRITICAL due to network attack vector requiring no privileges or user interaction, though attack complexity is high and specific timing conditions apply (AT:P). No CISA KEV listing or public POC identified at time of analysis, suggesting exploitation requires vendor-specific knowledge of the insecure defaults.

Technical ContextAI

This vulnerability exploits CWE-1188 (Initialization of a Resource with an Insecure Default), a flaw class where products ship with weak default configurations that create security gaps. In Pandora FMS - a network and infrastructure monitoring platform - the API component appears to initialize with insecure defaults that permit authentication bypass. The CPE identifier confirms all Pandora FMS versions from build 777 through 800 are affected across all deployment types. CVSS 4.0 vector indicates this is a network-accessible vulnerability (AV:N) with no scope change (S:N), meaning the compromise is contained to the vulnerable component itself but enables high confidentiality and integrity breaches (VC:H/VI:H) within that scope. The high attack complexity (AC:H) combined with specific present timing requirements (AT:P) suggests exploitation depends on particular deployment states or environmental conditions beyond simple network access.

RemediationAI

Upgrade to Pandora FMS version 801 or later, as all builds from 777-800 are confirmed vulnerable (patch availability inferred from vendor closing the version range at 800, though exact fix version not independently verified from provided data). Consult the official Pandora FMS security advisory at https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ for vendor-confirmed patch versions and migration guidance. If immediate upgrade is not feasible, implement compensating controls targeting the insecure default initialization: restrict API access to trusted IP ranges via firewall rules (blocks network vector but may impact legitimate monitoring integrations), disable the affected API endpoints if not operationally required (verify impact on monitoring workflows first), or re-initialize API authentication mechanisms with non-default credentials per vendor hardening guidance. Each mitigation carries operational risk - IP restrictions may block distributed monitoring agents, API disablement breaks automation integrations, and credential resets require coordination with all API consumers. Monitor authentication logs for anomalous API access patterns during the remediation window.