CVE-2025-26701
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2025-26701 is a critical-severity Use of Default Password (CWE-1393) vulnerability in Percona PMM Server (inferred from references). Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Default Accounts (T1078.001); ranked at the 37th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-26701 is a critical vulnerability affecting Percona PMM Server (OVA) versions before 3.0.0-1.ova. The issue stems from default service account credentials that enable unauthorized access. Exploitation allows attackers to gain SSH access to the server, escalate privileges using sudo to root level, and expose sensitive data. The vulnerability is associated with CWE-1393 and carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating maximum severity due to its network accessibility, low complexity, lack of prerequisites, and broad impact across confidentiality, integrity, and availability with scope change.
Any remote unauthenticated attacker can exploit this vulnerability over the network without user interaction. Successful exploitation grants full root access to the PMM Server instance via SSH, allowing arbitrary command execution, privilege escalation, and extraction of sensitive monitoring data collected by PMM. The high-impact score reflects the potential for complete system compromise and data exfiltration from monitored environments.
Percona's security advisory details the fix in PMM2 versions 2.42.0-1.ova, 2.43.0-1.ova, 2.43.1-1.ova, 2.43.2-1.ova, and 2.44.0-1.ova, as well as PMM3 3.0.0-1.ova and later. Security practitioners should immediately upgrade affected OVA deployments to patched versions and review default credentials in existing installations. Additional mitigation guidance is available at https://www.percona.com/blog/security-advisory-cve-affecting-percona-monitoring-and-management-pmm/.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7707
Vulnerability Data
An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can lead to SSH access, use of Sudo to root, and sensitive data exposure. This is fixed in PMM2 2.42.0-1.ova, 2.43.0-1.ova, 2.43.1-1.ova, 2.43.2-1.ova, and…
more
2.44.0-1.ova and in PMM3 3.0.0-1.ova and later.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Authenticator management requires verification of identity at initial distribution and secure handling that directly stops default passwords from remaining in use.
Configuration settings establish the most restrictive secure baselines, which include changing or disabling default passwords.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Credential management directly requires replacing default passwords with unique, strong credentials.
Hardened configuration baselines explicitly prohibit default passwords, covering most of the weakness but not all identity-management aspects.
Vulnerability scanning will discover default-password instances, enabling remediation, yet does not itself prevent their initial use.
Authentication policies can enforce non-default passwords but do not address the full scope of credential lifecycle.
Authorization policies assume credentials already exist and are not default; least-privilege helps limit impact but does not prevent defaults.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Mandates secure handling and change of authentication secrets, directly addressing default passwords.
Configuration management processes typically enforce changing defaults during hardening.
Requires secure authentication mechanisms, which includes replacing or disabling default credentials.
Utility programs often ship with defaults; control requires secure configuration before use.
Privileged accounts must not retain factory passwords, reducing risk of default-credential abuse.