CVE-2026-25212

Katalog CVE

CVSS 9.9 · Critical EPSS 0,29%

Kerentanan Execution with Unnecessary Privileges pada percona monitoring and management. Skor CVSS 3.1 9.9 (Critical) menurut CISA ADP.

Deskripsi (NVD)

An issue was discovered in Percona PMM before 3.7. Because an internal database user retains specific superuser privileges, an attacker with pmm-admin rights can abuse the "Add data source" feature to break out of the database context and execute shell commands on the underlying operating system.

Rincian

Terbit di NVD

2 April 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.9 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-250: Execution with Unnecessary Privileges

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 19,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docs.percona.com/percona-monitoring-and-management/3/release-notes/3.7.0.html#authenticated-remote-cod... release notes · advisory vendor
• https://percona.com product