Pandora Fms CVE-2026-34188

Attacker requires high-privilege administrative access to Pandora FMS versions 777–800. Exploitation occurs via OS Command Injection in Event Response execution feature. No victim interaction needed. Requires network access to Pandora FMS instance with Event Response functionality enabled.

Real-world risk is MODERATE despite the 7.5 CVSS score, constrained primarily by the high privilege requirement (PR:H). The CVSS 4.0 vector indicates network-accessible attack (AV:N) with low complexity (AC:L) but requires high privileges and presents attack complexity conditions (AT:P). While the technical impact is severe (VC:H, VI:H allows data theft and system modification), exploitation requires authenticated administrative access to Pandora FMS, significantly reducing the attack surface compared to unauthenticated vulnerabilities. EPSS data not provided, but the privilege barrier typically results in lower exploitation probability scores. No CISA KEV listing indicates no confirmed active exploitation campaigns. No public exploit identified at time of analysis. The SSVC framework would likely classify this as lower priority: exploitation requires admin compromise first (not automatable for initial access), technical impact is high but scoped to systems already under administrative control, and the deployment prevalence of Pandora FMS is limited compared to mass-market software. Primary risk scenarios involve insider threats, compromised admin credentials through phishing or credential stuffing, or as a privilege escalation step in multi-stage attacks where initial access was gained through other vulnerabilities. Organizations using Pandora FMS in DMZ or external-facing configurations face elevated risk if administrative interfaces are exposed.

An attacker who has compromised Pandora FMS administrative credentials (through phishing, credential reuse, or prior system compromise) authenticates to the web interface and navigates to the Event Response configuration. When creating or modifying an event response action, the attacker injects malicious OS commands into input fields that are passed unsanitized to system command execution functions, such as inserting semicolons followed by reverse shell commands. When the crafted event response triggers (either automatically through monitored events or manually), the injected commands execute with the privileges of the Pandora FMS server process, potentially granting the attacker persistent access, allowing lateral movement to monitored systems, or enabling data exfiltration from the monitoring infrastructure.