Cross-Site Request Forgery Vulnerability in Pandora FMS
CVE-2026-34190

5.9MEDIUM

Key Information:

Vendor: Pandora Fms
Status: Pandora Fms
Vendor: CVE Published:; 1 October 2026

🔔 Create Pandora Fms Vulnerability Alert

What is CVE-2026-34190?

A Cross-Site Request Forgery vulnerability in Pandora FMS allows attackers to exploit authenticated sessions of administrators by initiating unauthorized deletion of alert commands. This occurs when a logged-in administrator inadvertently visits a malicious web page that sends sequential, unvalidated GET requests. The vulnerability emphasizes the importance of validating requests to protect sensitive operations, particularly in versions from 777 onwards.

Affected Version(s)

Pandora FMS all 777

References

https://pandorafms.com/en/security/common-vulnerabilities...

CVSS V4

Score:

5.9

Severity:

MEDIUM

Confidentiality:

None

Integrity:

High

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

Physical

Privileges Required:

Undefined

User Interaction:

Unknown

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 1, 2026
Vulnerability Reserved
Mar 26, 2026

Credit

Gaurish Kauthankar (Argon21) & Mr. Omkar Naik

CVE-2026-34190 Data

JSON