Pandora Fms EUVD-2026-21990

Requires authenticated user access to Pandora FMS versions 777-800 with WebServerModuleDebug functionality enabled. Attacker must have login credentials to inject OS commands through the debug module. No victim interaction needed.

This vulnerability presents significant real-world risk despite requiring authentication. The CVSS 8.7 score accurately reflects the severity: network-accessible (AV:N), trivial to exploit once authenticated (AC:L), and delivering high confidentiality and integrity impact. The PR:L (low privileges required) means any authenticated user account can potentially exploit this, not just administrators. The CVSS 4.0 Safety Impact metrics (SC:L/SI:L/SA:L) indicate potential cascading effects beyond the vulnerable system itself, suggesting Pandora FMS's role in monitoring infrastructure could enable pivot attacks. The presence of S:N (Scope Not Changed) is counterbalanced by explicit Safety Impact scores, and the AU:Y (Automatable) flag indicates this could be incorporated into automated attack chains. While no EPSS data or KEV status is provided, and no public exploit identified at time of analysis, the combination of network exposure, low complexity, and command injection primitive makes this a high-priority remediation target. The R:U (Reasonable user interaction) and V:C (Value density Concentrated) suggest focused but high-value targets in monitoring deployments.

An attacker with valid low-privilege credentials to a Pandora FMS installation (versions 777-800) accesses the WebServerModuleDebug component and submits a crafted request containing malicious command injection payloads. Due to insufficient input validation, the injected commands execute on the underlying operating system with the privileges of the Pandora FMS process. The attacker uses this access to exfiltrate sensitive monitoring data, configuration files containing credentials for monitored systems, or establishes persistence for lateral movement to connected infrastructure that Pandora FMS monitors.