Pandora Fms EUVD-2026-21996

Requires authenticated user account on Pandora FMS versions 777-800. Attacker must have login credentials to access the module search functionality where SQL injection payload is injected. Remote network access required; no victim interaction needed.

Real-world risk assessment reveals moderate-to-high concern despite the 8.7 CVSS score. The CVSS 4.0 vector indicates network-based exploitation (AV:N) with low attack complexity (AC:L), but requires low-level authentication (PR:L), which reduces immediate risk compared to unauthenticated vulnerabilities. No EPSS score provided, no CISA KEV listing confirms active exploitation, and no public exploit code (POC) availability reported at time of analysis, suggesting this remains a disclosed but not yet weaponized vulnerability. The high confidentiality (VC:H) and integrity (VI:H) impact scores indicate serious consequences upon successful exploitation-attackers could extract sensitive monitoring data, credentials stored in the database, or manipulate monitoring configurations to hide malicious activity. The limited scope impact (S:N with SC:L/SI:L/SA:L) suggests damage may extend slightly beyond the vulnerable component but remains contained. SSVC decision framework considerations: exploitation status is public (vendor disclosed), automatable (SQL injection attacks are readily scriptable once entry point is identified), and technical impact is significant (database compromise). Priority depends on exposure-internet-facing Pandora FMS instances with weak authentication controls warrant immediate patching, while internally segmented deployments face lower urgency. The 777-800 version range represents a significant installation base requiring remediation.

An authenticated attacker with low-level Pandora FMS credentials accesses the module search interface and injects SQL metacharacters into search parameters, such as crafting a search query containing UNION SELECT statements or Boolean-based blind SQL injection payloads. The application processes this malicious input without proper sanitization, executing the attacker's SQL commands against the backend database. The attacker extracts sensitive monitoring data, administrative credentials, or network topology information, then modifies alert thresholds to suppress detection of ongoing malicious activity within the monitored infrastructure. Publicly available exploit code not confirmed, but SQL injection exploitation techniques are well-documented and readily adapted by attackers.