Pandora Fms EUVD-2026-21988

Pandora FMS versions 777–800 with Network Report feature enabled. Requires authenticated user account with permissions to create or modify network reports. Attacker injects OS commands through Network Report input fields.

Real-world risk assessment reveals a critical vulnerability with high exploitability but requiring authenticated access. CVSS 4.0 score of 8.7 reflects HIGH base severity with network attack vector, low complexity, and no user interaction required. The PR:L (low privileges) requirement means any authenticated user can exploit this, not just administrators. Impact is severe: high confidentiality and integrity impact (VC:H, VI:H) with low availability impact (VA:L) to the vulnerable system, plus limited subsequent system impacts (SC:L, SI:L, SA:L). The vulnerability is NOT in CISA KEV, indicating no confirmed active exploitation in real-world attacks. No public proof-of-concept code has been identified at time of analysis. Without EPSS data provided, we cannot quantify probabilistic exploitation likelihood, but the combination of network accessibility, low complexity, and command injection primitive suggests this would be highly attractive to attackers once exploit techniques become public. The SSVC framework indicators show: exploitation status is none (no POC/KEV), technical impact is total (arbitrary command execution enables full system compromise within security boundaries), and automatable is yes (command injection can be easily scripted). The authenticated requirement and lack of public exploits moderates immediate risk, but organizations running affected Pandora FMS versions should treat this as high priority given the monitoring platform's typical network position and access to sensitive infrastructure data.

An authenticated attacker with low-privilege credentials to a Pandora FMS monitoring console navigates to the Network Report functionality and crafts a malicious report parameter containing OS command injection payloads such as semicolons or pipe characters followed by system commands. When the application processes this report request, it fails to sanitize the input and executes the injected commands with the privileges of the Pandora FMS process, typically the web server user or a dedicated monitoring service account. The attacker can execute arbitrary commands to exfiltrate sensitive monitoring data including network credentials, install persistent backdoors, pivot to monitored systems using collected credentials, or manipulate monitoring configurations to hide malicious activity across the infrastructure.