Which versions of Pandora FMS are affected by CVE-2026-30808?

Pandora FMS versions 777-800 contain a session fixation vulnerability that allows attackers to hijack user sessions and gain unauthorized access to monitoring and management functions.

How to fix or mitigate CVE-2026-30808?

Within 24 hours: Audit all Pandora FMS deployments to identify instances running versions 777-800 and document current user base and system criticality. Within 7 days: Implement network-level controls to restrict Pandora FMS access to authenticated internal networks only, disable external web access if possible, and enforce session timeout policies to minimum 15-minute idle timeout. Within 30 days: Contact Pandora FMS vendor for patch availability and develop upgrade testing plan; if patch unavailable, evaluate migration to alternative monitoring solutions or isolate affected systems from production networks.

Pandora FMS CVE-2026-30808

Q: What is the CVSS score of CVE-2026-30808?

CVE-2026-30808 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:C/RE:L/U:Amber. EPSS exploitation probability: 0.0%.

EUVD-2026-29496 HIGH

Session Fixation (CWE-384)

2026-05-12 PandoraFMS

GHSA-j2qp-cx58-m78p

Session Fixation Information Disclosure

7.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:C/RE:L/U:Amber

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:C/RE:L/U:Amber

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 16:33 vuln.today

CVSS changed

May 12, 2026 - 16:22 NVD

7.6 (HIGH)

CVE Published

May 12, 2026 - 15:11 nvd

HIGH 7.6

DescriptionCVE.org

Session Fixation vulnerability allows Session Hijacking via crafted session ID. This issue affects Pandora FMS: from 777 through 800

AnalysisAI

Session fixation in Pandora FMS versions 777-800 enables session hijacking when attackers supply crafted session IDs to users. Successful exploitation grants attackers complete access to victim user sessions with high confidentiality and integrity impact. No public exploit code identified at time of analysis, though attack complexity is low with network-based delivery requiring only user interaction (CVSS 7.6).

Technical ContextAI

Session fixation (CWE-384) occurs when an application accepts externally-supplied session identifiers without proper regeneration upon authentication. In Pandora FMS - an open-source network monitoring platform - versions 777 through 800 fail to regenerate session tokens after login, allowing attackers to pre-set session IDs. The CVSS 4.0 vector shows network attack vector (AV:N), low complexity (AC:L), present attack requirements (AT:P), and required user interaction (UI:P), indicating the application accepts session IDs from URL parameters or cookies without validation. The affected CPE (cpe:2.3:a:pandora_fms:pandora_fms) confirms this targets the core Pandora FMS application across the specified version range.

RemediationAI

Upgrade Pandora FMS to version 801 or later, which presumably addresses the session fixation vulnerability (version inferred from 'through 800' statement - exact patched version not independently confirmed in provided data). Consult the Pandora FMS security advisory at https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ for official upgrade instructions and release notes. If immediate patching is infeasible, implement compensating controls: configure web application firewall rules to block session ID parameters in URLs (sid, sessionid, PHPSESSID patterns), enforce session regeneration through reverse proxy layer using mod_session or equivalent, and restrict Pandora FMS access to trusted networks via IP allowlisting. Note these mitigations reduce but do not eliminate risk, as cookie-based fixation may still be possible. Enable HTTP Strict Transport Security and secure cookie flags (HttpOnly, Secure, SameSite=Strict) to limit session token leakage vectors. Monitor authentication logs for suspicious session activity patterns such as session reuse across disparate IP addresses.