Which versions of Pandora Fms are affected by CVE-2026-34188?

CVE-2026-34188 is a critical command injection vulnerability in Pandora FMS versions 777-800 that allows authenticated administrators to execute arbitrary OS commands, potentially compromising system…

How to fix or mitigate CVE-2026-34188?

Within 24 hours: inventory all Pandora FMS deployments and identify instances running versions 777-800; restrict administrative access to Event Response functionality through access controls and privileged access management (PAM) policies. Within 7 days: implement compensating controls including network segmentation, activity logging on all administrative actions, and real-time monitoring of Event Response execution. Within 30 days: upgrade to Pandora FMS version 801 or later (if available from vendor) or evaluate alternative monitoring solutions; conduct access review of all administrative accounts and enforce multi-factor authentication (MFA) for administrative login.

Pandora Fms CVE-2026-34188

Q: What is the CVSS score of CVE-2026-34188?

CVE-2026-34188 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:C/RE:M/U:Amber. EPSS exploitation probability: 0.4%.

EUVD-2026-21999 HIGH

OS Command Injection (CWE-78)

2026-04-13 PandoraFMS

GHSA-xqmq-m74q-gr4q

Command Injection Pandora Fms

7.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:C/RE:M/U:Amber

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:52 vuln.today

cvss_changed

Analysis Generated

Apr 13, 2026 - 16:44 vuln.today

CVSS changed

Apr 13, 2026 - 16:22 NVD

7.5 (HIGH)

EUVD ID Assigned

Apr 13, 2026 - 16:15 euvd

EUVD-2026-21999

Analysis Generated

Apr 13, 2026 - 16:15 vuln.today

CVE Published

Apr 13, 2026 - 15:50 nvd

HIGH 7.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Event Response execution. This issue affects Pandora FMS: from 777 through 800

AnalysisAI

OS command injection in Pandora FMS versions 777 through 800 enables high-privileged remote attackers to execute arbitrary operating system commands through the Event Response execution functionality. While requiring administrative credentials (PR:H), successful exploitation grants extensive system access with high confidentiality and integrity impact. No public exploit identified at time of analysis, though the specific attack vector through Event Response features provides a clear exploitation pathway for authenticated administrators or compromised admin accounts.

Technical ContextAI

Pandora FMS is an enterprise monitoring platform that includes event management and automated response capabilities. This vulnerability stems from CWE-78 (OS Command Injection), where the Event Response execution mechanism fails to properly sanitize or validate user-supplied input before passing it to system command interpreters. The affected CPE (cpe:2.3:a:pandora_fms:pandora_fms) spans versions 777-800, indicating this is a vulnerability in the core event automation framework. OS command injection occurs when applications construct shell commands using concatenation or unsafe APIs without escaping special characters (semicolons, pipes, backticks, dollar signs), allowing attackers to break out of intended command context and inject arbitrary commands. In monitoring platforms like Pandora FMS, event response features typically execute system-level actions (scripts, notifications, remediation tasks), making them high-value targets if input validation is insufficient.

RemediationAI

Organizations running Pandora FMS versions 777-800 should immediately consult the official vendor security advisory at https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ for patch availability and upgrade instructions. Upstream fix available (PR/commit); released patched version not independently confirmed from available data sources at time of analysis, so verification with vendor is essential. As interim risk reduction measures pending patch deployment, organizations should restrict administrative access to Pandora FMS consoles through network segmentation, implement multi-factor authentication for all administrative accounts, audit existing Event Response configurations for suspicious command patterns, enable comprehensive logging of Event Response executions, and review administrative account usage for signs of compromise. Consider disabling Event Response functionality entirely if not operationally required until patching is complete. Implement principle of least privilege by limiting which administrator accounts can configure Event Response actions.