Pandora FMS CVE-2026-34190

Exploitation requires an authenticated Pandora FMS administrator (version 777 or later) to have an active session and to visit an attacker-controlled web page while that session is live (UI:A/Active). The vulnerable behavior is that state-changing alert-command deletions are exposed via GET requests that lack anti-CSRF validation, so a cross-origin page can trigger them without the attacker ever authenticating. Limiting factors: the attacker cannot act without victim interaction, the victim must specifically hold administrator privileges, and the impact is confined to deletion of alert commands (no data read). No special non-default server configuration is indicated.

This is a CSRF flaw (CWE-352) in Pandora FMS scored by the vendor (PandoraFMS as CNA) at CVSS 4.0 5.9 (Medium). The 4.0 vector AV:N/AC:L/AT:P/PR:N/UI:A conveys the defining trait of CSRF: the attacker is unauthenticated (PR:N) but cannot act alone - exploitation is entirely gated on an authenticated administrator being lured into visiting an attacker-controlled page (UI:A/Active), and the AT:P 'attack requirement' reflects that the victim must hold a valid admin session at that moment. Impact is integrity-dominant (VI:H - unauthorized deletion of alert commands) with a secondary availability effect (VA:L, since destroyed alert definitions degrade monitoring coverage) and no confidentiality impact (VC:N). There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the supplied data, so exploitation status is: no public exploit identified at time of analysis. Net assessment: this is a genuine but conditional, Medium-severity issue, not a drop-everything priority - the signals are internally consistent (no inflated CVSS, no conflicting exploitation evidence), and the heavy reliance on tricking a logged-in admin substantially limits real-world weaponization compared to a server-side unauthenticated flaw.

An attacker crafts a malicious web page (or email/forum link) containing hidden, auto-firing sequential GET requests that target Pandora FMS alert-command deletion endpoints. While logged into the Pandora FMS console, an administrator is social-engineered into opening that page; the browser silently replays the forged requests with the admin's valid session cookies, deleting alert commands without validation. No public proof-of-concept is identified at time of analysis, and success depends on the victim being authenticated at the time of the visit.