Which versions of Pandora Fms are affected by CVE-2026-34186?

Pandora FMS versions 777-800 contain a high-severity SQL injection vulnerability (CVSS 8.7) accessible to authenticated users that could allow attackers to extract sensitive monitoring data, alter…

How to fix or mitigate CVE-2026-34186?

Within 24 hours: inventory all Pandora FMS deployments and document versions 777-800 in use; restrict network access to Pandora FMS web interfaces to trusted IP ranges or VPN only. Within 7 days: disable or revoke low-privilege user accounts not essential for operations; apply input validation and SQL parameterization reviews to custom field handling. Within 30 days: monitor vendor advisories for patch release targeting versions 777-800; prepare testing and deployment procedures for patched versions; consider upgrading to a version outside the affected range if patches remain unavailable.

Pandora Fms CVE-2026-34186

Q: What is the CVSS score of CVE-2026-34186?

CVE-2026-34186 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Amber. EPSS exploitation probability: 0.0%.

EUVD-2026-21998 HIGH

SQL Injection (CWE-89)

2026-04-13 PandoraFMS

GHSA-4hgf-5jwc-7v3g

SQLi Pandora Fms

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Amber

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:52 vuln.today

cvss_changed

Analysis Generated

Apr 13, 2026 - 16:43 vuln.today

CVSS changed

Apr 13, 2026 - 16:22 NVD

8.7 (HIGH)

EUVD ID Assigned

Apr 13, 2026 - 16:15 euvd

EUVD-2026-21998

Analysis Generated

Apr 13, 2026 - 16:15 vuln.today

CVE Published

Apr 13, 2026 - 15:49 nvd

HIGH 8.7

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via custom fields. This issue affects Pandora FMS: from 777 through 800

AnalysisAI

SQL injection in Pandora FMS versions 777 through 800 enables authenticated remote attackers to execute arbitrary SQL commands via specially crafted custom field inputs, potentially exposing sensitive monitoring data, modifying database contents, or compromising the underlying infrastructure management system. The vulnerability requires low-privilege authentication (PR:L) but has high confidentiality and integrity impact across the monitoring platform. No public exploit code or active exploitation confirmed at time of analysis, though the straightforward attack complexity (AC:L) and network accessibility (AV:N) elevate real-world risk for internet-exposed Pandora FMS instances.

Technical ContextAI

Pandora FMS is an enterprise monitoring and network management platform written in PHP with MySQL/PostgreSQL backends. This CWE-89 SQL injection flaw stems from improper input validation and sanitization of user-supplied data within the custom fields functionality-a feature allowing administrators to define metadata fields for monitored devices and services. The affected component fails to neutralize SQL metacharacters (quotes, semicolons, UNION operators) before incorporating custom field values into dynamically constructed database queries. The CPE identifier cpe:2.3:a:pandora_fms:pandora_fms confirms this affects the core Pandora FMS application across a continuous version range (777-800), indicating a systemic input handling deficiency introduced or perpetuated across multiple releases. The CVSS 4.0 vector reveals network-based exploitation with low complexity, requiring only low-privilege authenticated access, making this exploitable by any legitimate user with custom field modification permissions.

RemediationAI

Immediately upgrade Pandora FMS to version 801 or later, which contains input validation fixes for custom field SQL injection vulnerabilities. Download the latest stable release from the official Pandora FMS repository or apply vendor-supplied patches through your existing update mechanism. For urgent interim mitigation where immediate patching is not feasible, restrict custom field modification permissions to only highly trusted administrative accounts via the Pandora FMS role-based access control system (Profile Management), reducing the pool of potential attackers. Implement web application firewall (WAF) rules to detect and block SQL injection patterns in POST requests to custom field endpoints, though this provides only partial defense-in-depth. Audit database query logs for anomalous SQL syntax or UNION-based injection attempts targeting custom field tables as indicators of exploitation attempts. Review all existing custom field values for suspicious SQL fragments that may indicate prior compromise. Consult the vendor security advisory at https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ for version-specific remediation guidance and supplementary hardening recommendations.