Pandora FMS CVE-2026-30807

Requires an authenticated Pandora FMS user (typically an administrator or operator with elevated privileges) to interact with an attacker-controlled web page while maintaining an active session with the vulnerable Pandora FMS instance. The victim must use a browser that transmits session cookies cross-origin (default behavior in browsers without SameSite=Strict enforcement). Limiting factors: user interaction is mandatory (UI:P in CVSS vector) - automated mass exploitation is not feasible; attackers need knowledge of the target's Pandora FMS endpoints and functionality to craft effective forged requests; exploitation window is constrained by session timeout durations configured in the target environment. Network accessibility (AV:N) means attacks work against internet-exposed or intranet-deployed instances, but PR:N indicates no attacker authentication to Pandora FMS itself is required - victim's credentials are hijacked through the CSRF mechanism.

Real-world risk is moderate-high for organizations with active Pandora FMS deployments. The CVSS 7.1 score reflects genuine impact: high integrity compromise (VI:H) permits unauthorized configuration changes, user creation, or monitoring policy modifications, while limited confidentiality impact (VC:L) suggests some data exposure during exploitation. Attack complexity is low (AC:L) with no privileges required (PR:N), but mandatory user interaction (UI:P) creates an exploitability barrier - attackers must socially engineer authenticated administrators to visit malicious sites during active sessions. The CVSS vector specifies no scope change (S:N), limiting damage to the vulnerable application context. Critically, no EPSS score is available to quantify real-world exploitation probability, and CISA KEV absence suggests no confirmed mass exploitation campaigns. However, CSRF vulnerabilities targeting administrative interfaces historically attract opportunistic attackers when targeting-specific organizations. The 'U:Amber' supplemental metric indicates broader ecosystem risk if Pandora FMS instances manage critical infrastructure monitoring. Organizations must verify whether affected versions 777-800 align with their deployments; versions outside this range are unaffected per available data.

An attacker identifies a Pandora FMS administrator through LinkedIn reconnaissance or phishing intelligence gathering. They craft a malicious webpage containing hidden HTML forms that auto-submit POST requests to known Pandora FMS administrative endpoints (e.g., user creation, alert policy modification). The attacker delivers this page via spear-phishing email with a pretext like 'Q1 Security Report' or embeds it in a compromised industry forum frequented by IT professionals. When the victim clicks the link while authenticated to their Pandora FMS console in another browser tab, the malicious page executes cross-origin requests using the victim's session cookies, creating backdoor admin accounts or disabling critical monitoring alerts without the victim's awareness.