Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Locate exposed pmproxy port (44322)
  2. Delivery
    Send crafted request to /store endpoint
  3. Exploit
    Bypass access control checks
  4. Execution
    Overwrite target PMDA metric value
  5. Persist
    Trigger code execution in agent context
  6. Impact
    System takeover

Vulnerability Assessment

Weakness
CWE
CWE-284
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK

1 technique across 1 tactic: Defense Evasion

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires network reachability to the PCP pmproxy service and its /store endpoint being enabled/exposed (pmproxy typically listens on TCP 44322). No authentication is required (CVSS PR:N) and no user interaction (UI:N), and requests are low-complexity to craft (AC:L). Limiting factors: pmproxy must be running and network-accessible from the attacker (many deployments bind it locally or to a management network), the target PMDA metric must be writable/actionable for the impact to escalate beyond a benign metric write, and the full arbitrary-code-execution outcome is reporter-asserted rather than confirmed by an independent POC - instances with pmproxy firewalled or localhost-bound are not remotely exploitable.
Impact

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L = 7.3) describes a trivially reachable, unauthenticated, low-complexity network attack, which is a genuine priority signal. However, there is a notable internal conflict: the description claims 'arbitrary code execution and system takeover' yet the vendor scored all three impacts as only Low (C:L/I:L/A:L) - RCE would normally warrant High impacts and a ~9.8 score. This suggests Red Hat scoped the practical impact conservatively (e.g. code execution constrained to the pcp/PMDA service context or contingent on specific writable PMDAs), so the RCE-to-full-takeover claim should be treated as reporter-asserted, not independently confirmed. No EPSS score, KEV listing, POC, or SSVC decision data was provided. Real-world risk is gated primarily by exposure: pmproxy is not always network-reachable, so internet- or untrusted-network-exposed instances are high priority while internal/localhost-bound deployments are lower.
Exploit ScenarioDerived

An attacker who can reach a target's pmproxy port sends crafted unauthenticated HTTP requests to the /store endpoint, bypassing access control to overwrite a PMDA metric that a privileged consumer or the agent itself acts upon. Per the reporter this metric overwrite is escalated into arbitrary code execution, yielding control of the monitoring service context or host. No public POC was identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Remote unauthenticated access-control bypass in the Performance Co-Pilot (PCP) pmproxy component lets attackers reach the /store endpoint and overwrite arbitrary PMDA (Performance Metrics Domain Agent) metric values, which the reporter (Red Hat) states can escalate to arbitrary code execution and full system takeover. The flaw affects PCP as shipped across Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack surface makes exposed pmproxy instances a meaningful risk.

RemediationAI

Apply the Red Hat pcp/pmproxy security update for your RHEL or OpenShift release once available; no exact fixed version was provided in the input, so verify the patched package via the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-16527) and Bugzilla 2506031. As compensating controls until patched: restrict network access to the pmproxy listener (default TCP 44322, and pmcd 44321) so it is reachable only from trusted management hosts via host firewall or network ACLs; bind pmproxy to localhost or a management interface rather than 0.0.0.0; and if the /store write path is not required for your monitoring use case, disable metric storing / avoid exposing writable PMDAs. Trade-offs: firewalling or localhost-binding pmproxy breaks remote metric collection and dashboards that pull through the proxy, and disabling store functionality removes the ability to push metric values back to agents.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Performance Co-Pilot is a system performance monitoring framework bundled with RHEL. The pmproxy daemon is a REST/protocol proxy that fronts the pmcd metrics collector and its domain agents (PMDAs); its /store endpoint is intended to write (store) metric values back into instrumented agents. The vulnerability is an access-control bypass: crafted requests to /store defeat the intended authorization checks, allowing an unauthenticated caller to store/overwrite values for any PMDA. Because some PMDAs act on stored values (e.g. driving actions or being consumed by privileged processes), an attacker-controlled metric write can be leveraged into code execution. No CWE was supplied, but the behavior maps to a Missing/Improper Authorization class (CWE-862/CWE-285) enabling downstream code injection.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.3 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
vuln.today AI 7.3 HIGH

Unauthenticated low-complexity network access (AV:N/AC:L/PR:N/UI:N) is clear; I retain the vendor's Low impacts because the RCE/takeover claim is unconfirmed and likely constrained to the PMDA service context rather than full-High host compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE 7.5 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Red Hat 7.3 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

DescriptionCVE.org

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.

Executive ViewAI

Why It Matters

Performance Co-Pilot (PCP) pmproxy in Red Hat Enterprise Linux and OpenShift Container Platform contains a remote unauthenticated access-control bypass allowing attackers to achieve full system compromise through arbitrary code execution. No vendor patch is currently available, leaving organizations with exposed pmproxy instances at immediate risk.

Business Impact: High
Compensating Controls

Implement network access controls restricting pmproxy connectivity to trusted administrative networks only; disable the pmproxy service entirely on systems where performance monitoring is not essential; deploy network-based detection signatures for anomalous /store endpoint access; implement network segmentation and strict egress filtering to contain lateral movement if an instance is compromised.

Threat Intelligence Overview

EPSS Score
0.4%
Top 68% exploitable
Prevalence
High
PCP ships with all supported RHEL and OpenShift releases, broad enterprise footprint
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.4%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-284 – Improper Access Control

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-16527 ADVISORY https://vuldb.com/vuln/384614 REF https://access.redhat.com/errata/RHSA-2026:55560 REF https://access.redhat.com/errata/RHSA-2026:55617 REF https://access.redhat.com/errata/RHSA-2026:55740 REF https://access.redhat.com/errata/RHSA-2026:72272 REF https://access.redhat.com/errata/RHSA-2026:72273 REF https://access.redhat.com/errata/RHSA-2026:72593 REF https://access.redhat.com/errata/RHSA-2026:72594 REF https://access.redhat.com/errata/RHSA-2026:73767 REF https://access.redhat.com/errata/RHSA-2026:74612 REF https://access.redhat.com/errata/RHSA-2026:74613 REF https://access.redhat.com/security/cve/CVE-2026-16527 REF https://bugzilla.redhat.com/show_bug.cgi?id=2506031

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy