by Kastro
Paper/Archive/CVE-2025-26701

CVE-2025-26701

Percona Monitoring and Management — An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova.

EPSS 0.5%CVSS 10.0
critical.is priorityof 100
38
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 39.9.399 × 208.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can lead to SSH access, use of Sudo to root, and sensitive data exposure. This is fixed in PMM2 2.42.0-1.ova, 2.43.0-1.ova, 2.43.1-1.ova, 2.43.2-1.ova, and 2.44.0-1.ova and in PMM3 3.0.0-1.ova and later.

Affected

ProductAffectedFixed inSource
Monitoring and Management2.38 – < 2.42.0-1.ova2.42.0-1.ovaCNA
Monitoring and Management2.43.0 – < 2.43.0-1.ova2.43.0-1.ovaCNA
Monitoring and Management2.43.1 – < 2.43.1-1.ova2.43.1-1.ovaCNA
Monitoring and Management2.43.2 – < 2.43.2-1.ova2.43.2-1.ovaCNA
Monitoring and Management2.44.0 – < 2.44.0-1.ova2.44.0-1.ovaCNA
Monitoring and Management3.0.0 – < 3.0.0-1.ova3.0.0-1.ovaCNA

Scores by source

mitre (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refpercona.com/blog/security-advisory-cve-affecting-percona-monitoring-and-management-pmm