CVE-2026-30809 is an OS Command Injection vulnerability in Pandora FMS versions 777 through 800 that stems from improper neutralization of special elements in the WebServerModuleDebug function, allowing attackers to execute arbitrary commands on affected systems. The vulnerability carries a CVSS score of 8.8 (HIGH) with a network-based attack vector requiring low complexity and valid user credentials, resulting in potential compromise of confidentiality, integrity, and availability. The attack has not been added to the Known Exploited Vulnerabilities (KEV) catalog, and exploitation in the wild appears minimal with an EPSS score of 0.0014, indicating this CVE is exploited less frequently than the vast majority of other disclosed vulnerabilities. The vulnerability is currently inactive on security watch lists and has not generated significant community attention. Organizations running affected versions should prioritize patching to mitigate the risk of authenticated command injection attacks.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 777, <= 800CPE match | cpe:2.3:a:pandorafms:pandora_fms:*:*:*:*:*:*:*:* | ||
>= 777, < 800.1CPE matchmatch criteria | cpe:2.3:a:artica:pandora_fms:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.