CVE-2026-34186
Published: 13 April 2026
Summary
CVE-2026-34186 is a high-severity SQL Injection (CWE-89) vulnerability in Artica Pandora Fms. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-34186 is an Improper Neutralization of Special Elements used in an SQL Command vulnerability (CWE-89) that enables SQL injection attacks via custom fields in Pandora FMS, affecting versions from 777 through 800. Published on 2026-04-13, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability.
An attacker with low-privilege authenticated access (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low complexity (AC:L) and no user interaction required (UI:N). Successful exploitation allows arbitrary SQL commands to be injected via custom fields, potentially enabling data exfiltration, modification, or deletion, as well as denial-of-service impacts given the high ratings for C:H, I:H, and A:H.
Mitigation details are available in the vendor advisory at https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/. Security practitioners should prioritize patching affected Pandora FMS installations to versions outside the 777-800 range and review access controls for custom field usage.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21998
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via custom fields. This issue affects Pandora FMS: from 777 through 800
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote SQL injection flaw (CWE-89) in the Pandora FMS web application with network attack vector (AV:N) and low privileges required (PR:L), directly enabling exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of information inputs like custom fields to neutralize special elements and prevent SQL injection (CWE-89) in Pandora FMS.
Mandates timely remediation of the specific SQL injection flaw affecting Pandora FMS versions 777 through 800, aligning with vendor patching guidance.
Enforces restrictions on input formats, lengths, and character sets for custom fields to mitigate SQL injection attempts.