Which versions of Pandora Fms are affected by EUVD-2026-21996?

Pandora FMS versions 777-800 contain a SQL injection vulnerability in the module search function that allows authenticated users with low-level privileges to read, modify, or delete database…

How to fix or mitigate EUVD-2026-21996?

Within 24 hours: Identify all Pandora FMS deployments running versions 777-800 and document network exposure and user access levels. Within 7 days: Implement network segmentation or access controls to restrict Pandora FMS module search functionality to trusted networks and users; apply principle of least privilege to Pandora FMS service accounts and user roles. Within 30 days: Evaluate upgrade feasibility to a patched version beyond 800; if upgrade is not possible, deploy a Web Application Firewall (WAF) rule to detect and block SQL injection patterns in search parameters; conduct database backup and restore procedure testing.

Pandora Fms EUVD-2026-21996

Q: What is the CVSS score of EUVD-2026-21996?

EUVD-2026-21996 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Amber. EPSS exploitation probability: 0.0%.

| CVE-2026-30813 HIGH

SQL Injection (CWE-89)

2026-04-13 PandoraFMS

GHSA-chf8-3p4x-rchj

SQLi Pandora Fms

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Amber

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:52 vuln.today

cvss_changed

Analysis Generated

Apr 13, 2026 - 16:43 vuln.today

CVSS changed

Apr 13, 2026 - 16:22 NVD

8.7 (HIGH)

EUVD ID Assigned

Apr 13, 2026 - 16:15 euvd

EUVD-2026-21996

Analysis Generated

Apr 13, 2026 - 16:15 vuln.today

CVE Published

Apr 13, 2026 - 15:49 nvd

HIGH 8.7

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via module search. This issue affects Pandora FMS: from 777 through 800

AnalysisAI

SQL injection in Pandora FMS module search functionality allows authenticated attackers to extract, modify, or delete database contents across versions 777 through 800. Attackers with low-level privileges can execute arbitrary SQL commands through improperly sanitized search parameters, leading to high confidentiality and integrity impact. No confirmed active exploitation (CISA KEV) at time of analysis, though the straightforward attack vector (network-accessible, low complexity, authenticated) and limited scope suggest moderate real-world risk for exposed instances.

Technical ContextAI

This vulnerability stems from CWE-89 (SQL Injection), where user-supplied input in Pandora FMS's module search feature is not properly sanitized before inclusion in SQL queries. Pandora FMS is a network and infrastructure monitoring platform that relies on database operations for managing monitored modules, agents, and alerts. The affected component fails to neutralize special SQL characters or employ parameterized queries, allowing authenticated users to inject malicious SQL syntax. The CPE string (cpe:2.3:a:pandora_fms:pandora_fms:*:*:*:*:*:*:*:*) indicates broad impact across all deployment types of the product. The CVSS vector shows network attack vector (AV:N) with low complexity (AC:L), requiring only low-level privileges (PR:L) and no user interaction (UI:N), making exploitation straightforward for authenticated attackers. The vulnerability affects both confidentiality and integrity of the vulnerable system (VC:H/VI:H) with limited scope impact (SC:L/SI:L/SA:L), suggesting potential for lateral data access beyond the immediate application database.

RemediationAI

Organizations should upgrade Pandora FMS to a patched version beyond the vulnerable 777-800 range. While the vendor advisory at https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ acknowledges the issue, the exact fixed version number is not independently confirmed from available data-consult the vendor portal directly for the latest patched release. As an interim mitigation, restrict network access to the Pandora FMS interface using firewall rules or VPN requirements, enforce strong authentication policies to limit the pool of potential low-privilege attackers, implement database activity monitoring to detect SQL injection attempts, and review user permission models to ensure least-privilege access to module search functionality. Apply web application firewall (WAF) rules targeting SQL injection patterns as a temporary control layer, though this is not a substitute for patching. Verify the integrity of existing database contents if unauthorized access is suspected, as attackers may have modified monitoring configurations or extracted credentials.