Pandora FMS EUVD-2026-29512

Authenticated access to Pandora FMS with low-privilege user account credentials is required (PR:L from CVSS vector). The attacker must have network access to the Pandora FMS web interface (AV:N) and ability to interact with graph container management features. High attack complexity (AC:H) indicates exploitation requires specialized knowledge of Pandora FMS's SQL query construction patterns and potentially precise timing to exploit race conditions or specific application states (AT:P). Exploitation is LIMITED by the need for valid authentication credentials, reducing risk from internet-facing deployments where attacker must first compromise legitimate user accounts. The requirement for high attack complexity and timing precision further limits exploitation to skilled attackers with deep knowledge of the platform, making mass automated exploitation unlikely. No user interaction required (UI:N) once authenticated access is obtained.

Real-world risk is moderate despite a 7.6 CVSS score due to multiple limiting factors. The CVSS 4.0 vector shows high attack complexity (AC:H) with present attack techniques requiring specific timing (AT:P), indicating exploitation is not straightforward or reliable. Authentication requirement (PR:L) reduces the attack surface to compromised or malicious authenticated users with low privileges. Impact is confidentiality and integrity compromise (VC:H/VI:H) but no availability impact (VA:N), with no scope change (S:N), limiting lateral movement potential. EPSS probability not provided for comparison. No CISA KEV listing indicates no confirmed active exploitation in the wild. The vulnerability affects a specific version range (777-800), suggesting a regression or newly introduced feature rather than a longstanding issue, which typically means fewer deployed vulnerable instances. The narrow affected version range and authentication requirement make this a lower priority than unauthenticated RCE vulnerabilities, but organizations running affected Pandora FMS versions should prioritize patching due to the potential for privileged database access escalation by low-privilege authenticated users.

An authenticated attacker with low-privilege access to Pandora FMS crafts a malicious graph container parameter containing SQL injection payloads such as UNION-based queries or boolean-based blind injection techniques. Due to high attack complexity and present attack technique timing requirements, the attacker must carefully craft requests to align with specific application state conditions or timing windows. Upon successful exploitation, the attacker escalates database privileges to extract sensitive monitoring data including credentials, infrastructure topology, or business-critical metrics, or manipulates monitoring configurations to hide malicious activity from security teams.