Pandora FMS CVE-2026-64949

Requires an authenticated, high-privilege Pandora FMS console session with access to the File Manager module (PR:H). The specific prerequisite is the File Manager's incomplete extension blacklist, which fails to block .phar files; the attacker must be able to both upload to and subsequently request files from a web-accessible directory so the server executes the uploaded PHP archive. Affects Pandora FMS versions 777 and later. Limiting factors: privileged authentication is mandatory (no unauthenticated path), no user interaction is required (UI:N), and exploitation depends on the File Manager module being enabled and reachable for the attacker's role.

The CVSS 4.0 base score is 8.6 (High), but this figure benefits from the vendor's inclusion of environmental/threat modifiers (AU:Y/R:I/V:C/RE:M/U:Red); the pure base impact is better read through the core vector AV:N/AC:L/AT:N/PR:H/UI:N with VC:H/VI:H/VA:H and no scope change (SC/SI/SA:N). The decisive mitigating factor is PR:H - exploitation requires an already-authenticated, high-privilege account with access to the File Manager module, which places this firmly in the post-authentication RCE category rather than a pre-auth internet-exposed threat. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so exploitation status is: no public exploit identified at time of analysis. There is no SSVC decision data supplied. Net assessment: a genuinely high-impact flaw (arbitrary code execution on the host) but gated behind privileged authentication, making it a priority primarily for environments where many users hold File Manager rights or where privilege boundaries are weak - not a mass-exploitation candidate. One caveat: PR:H is the vendor's self-assessment; if the File Manager is reachable by lower-privileged console roles in practice, real-world privilege requirements could be lower than stated - verify role gating with the vendor.

An attacker who has obtained a privileged Pandora FMS console account (or an insider with File Manager access) uploads a crafted .phar file whose extension slips past the module's incomplete blacklist, then requests that file through the web server to trigger PHP execution and run arbitrary code on the monitoring host. No proof-of-concept is publicly identified, and the network attack vector with low complexity means the upload-and-trigger sequence is straightforward once authenticated.