Pandora Fms EUVD-2026-21998

Authenticated user with privileges to create or modify custom fields in Pandora FMS versions 777-800. Remote attacker requires valid login credentials. No victim interaction needed; attacker can inject malicious SQL directly through custom field functionality.

Real-world risk is HIGH despite no confirmed active exploitation (not in CISA KEV) or public proof-of-concept. The CVSS 8.7 score accurately reflects severe impact: VC:H/VI:H indicates full database compromise potential, while SC:L/SI:L shows limited but non-zero downstream impact to connected monitoring infrastructure. Attack complexity AC:L and privilege requirement PR:L create a low barrier-any authenticated user (helpdesk staff, junior operators) with custom field access can exploit this without specialized tools. Network vector AV:N expands the attack surface to internet-exposed instances, common in SaaS monitoring deployments or MSSP environments. The SSVC framework elevates priority: exploitation is straightforward (automatable via scripting), technical impact is total database control, and Pandora FMS manages critical infrastructure visibility-making this a potential precursor to broader operational technology compromise. Monitoring platforms are high-value targets holding credentials, topology data, and privileged access to managed devices. While EPSS data is unavailable and no POC exists publicly, the combination of simple exploitation requirements and catastrophic potential impact positions this as an immediate patching priority for organizations running affected versions, particularly those with external exposure or untrusted internal users.

An authenticated attacker with low-privilege monitoring operator credentials accesses the Pandora FMS custom fields management interface and creates or modifies a custom field definition, injecting SQL metacharacters and UNION SELECT statements into the field name or default value parameter. When the application processes this input to store or retrieve custom field data, the malicious SQL executes within the database context, allowing the attacker to extract authentication hashes for all Pandora FMS users, enumerate monitored device credentials stored in the configuration database, or modify alert thresholds to suppress detection of ongoing infrastructure attacks. The attacker leverages this database access to pivot into the monitoring platform's underlying operating system or connected network devices using exposed credentials.