CVE-2026-16527

High

Open

TLP:CLEAR

Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.

Details

CVSS Score: 7.3
EPSS Score ⓘ: 0.40%

32.6th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Confidence: 90%
Published: Jul 30, 2026
Last Modified: Aug 7, 2026

Notes

0

Log in to add a note

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

0

Log in to add an opinion

No opinions yet. Be the first to assess this intelligence.