Pandora FMS CVE-2026-34189

Exploitation requires an authenticated Pandora FMS administrator (version 777 or later) to be lured, while logged in, into visiting an attacker-controlled web page that issues a forged GET request to the event-response deletion function. The limiting factors are significant: the target endpoint accepts state-changing actions via GET and lacks anti-CSRF token validation, the victim must hold administrative privileges, the victim must have an active authenticated session, and the victim must perform user interaction (visit the malicious page) - the attacker needs no credentials of their own but cannot act without this social-engineering step. Impact is bounded to deletion of event responses rather than full administrative takeover.

This is a classic CSRF (CWE-352) with a realistic but constrained risk profile. The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L) scores 5.9 (Medium): network-reachable and low-complexity, but gated by two meaningful dampeners - AT:P (a present attack requirement, reflecting the forged-request/timing dependency typical of CSRF) and UI:A (active victim interaction, i.e. an authenticated administrator must be lured to a malicious page). Impact is integrity-focused (VI:H = unauthorized deletion of event responses) with minor availability impact (VA:L) and no confidentiality impact (VC:N) - the attacker destroys data but reads nothing and does not gain a session. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. SSVC-style reasoning: exploitation is not automatable (it depends on social-engineering a specific privileged user), technical impact is partial (bounded to event-response deletion, not full system compromise). Net: a legitimate issue worth patching on a normal cycle, not an emergency - it is a medium-CVSS/medium-real-risk finding rather than a high-urgency one. The vector is self-consistent with the description; note that PR:N reflects the attacker's lack of credentials while the exploit still requires an already-authenticated admin victim - these are not contradictory for CSRF.

An attacker crafts a web page containing a forged GET request targeting the Pandora FMS event-response deletion endpoint and lures a logged-in Pandora FMS administrator into visiting it (e.g. via a phishing link). The administrator's browser automatically sends the request with their valid session, silently deleting event responses without consent. No public proof-of-concept is identified in the available data.