Which versions of Pandora Fms are affected by CVE-2026-30806?

Pandora FMS versions 777-800 contain a command injection vulnerability in Network Report functionality that allows low-privileged authenticated users to execute arbitrary system commands on the…

How to fix or mitigate CVE-2026-30806?

Within 24 hours: Inventory all Pandora FMS instances and identify those running versions 777-800; restrict Network Report access via firewall/WAF rules to trusted administrators only. Within 7 days: Contact Pandora FMS vendor for patch timeline and interim mitigation guidance; test deployment of input validation WAF rules if available. Within 30 days: Upgrade all affected instances to a version newer than 800 (pending vendor patch release confirmation); validate remediation by attempted command injection testing.

Pandora Fms CVE-2026-30806

Q: What is the CVSS score of CVE-2026-30806?

CVE-2026-30806 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber. EPSS exploitation probability: 0.6%.

EUVD-2026-21988 HIGH

OS Command Injection (CWE-78)

2026-04-13 PandoraFMS

Command Injection Pandora Fms

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:52 vuln.today

cvss_changed

Analysis Generated

Apr 13, 2026 - 16:42 vuln.today

CVSS changed

Apr 13, 2026 - 16:22 NVD

8.7 (HIGH)

EUVD ID Assigned

Apr 13, 2026 - 16:15 euvd

EUVD-2026-21988

Analysis Generated

Apr 13, 2026 - 16:15 vuln.today

CVE Published

Apr 13, 2026 - 15:45 nvd

HIGH 8.7

DescriptionCVE.org

Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Network Report. This issue affects Pandora FMS: from 777 through 800

AnalysisAI

OS command injection in Pandora FMS versions 777 through 800 allows authenticated remote attackers to execute arbitrary system commands via the Network Report functionality. The vulnerability stems from improper input sanitization of special elements used in OS commands. With CVSS 8.7 (HIGH) severity and network-accessible attack vector requiring only low privileges, this poses significant risk to monitoring infrastructure despite no confirmed active exploitation (not in CISA KEV) or public exploit code at time of analysis.

Technical ContextAI

The vulnerability resides in Pandora FMS, an open-source network monitoring and management solution. The affected component is the Network Report feature, which appears to accept user-supplied input that gets incorporated into system command execution without proper sanitization. CWE-78 (OS Command Injection) indicates the application constructs OS commands using externally-influenced input but fails to neutralize or incorrectly neutralizes special elements that could modify the intended command. The CPE string cpe:2.3:a:pandora_fms:pandora_fms identifies the Pandora FMS application as the vulnerable product. Versions 777 through 800 (approximately 23 consecutive releases) are confirmed affected, suggesting this is a design flaw introduced in version 777 or a long-standing weakness not previously identified. The CVSS 4.0 vector indicates network accessibility (AV:N), low attack complexity (AC:L), no additional attack requirements (AT:N), and requirement for low-privileged authentication (PR:L), meaning any authenticated user regardless of permission level could potentially exploit this vulnerability.

RemediationAI

Organizations running Pandora FMS versions 777-800 should immediately consult the vendor security advisory at https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ for patch availability and upgrade instructions. Upstream fix available per vendor advisory; specific patched version number not independently confirmed from available data. Until patching is completed, implement immediate compensatory controls: restrict network access to the Pandora FMS web interface to trusted administrator IP addresses only using firewall rules or web server access controls, review and audit all user accounts with access to Network Report functionality, enable comprehensive command execution logging on the Pandora FMS server to detect exploitation attempts, and consider disabling the Network Report feature entirely if not operationally critical. For organizations unable to patch immediately, deploy web application firewall rules to inspect and block requests to Network Report endpoints containing command injection metacharacters (semicolons, pipes, backticks, dollar signs with parentheses). Verify patch effectiveness post-deployment by reviewing server-side input validation in the Network Report code path.