PT-2025-10856 · Percona · Percona Pmm Server

Matt Kane · Published 2025-03-11 · Updated 2025-03-17 · CVE-2025-26701

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Percona PMM Server (OVA) versions prior to 3.0.0-1.ova

Description: An issue was discovered in Percona PMM Server (OVA) where the default service account credentials can lead to SSH access, use of Sudo to root, and sensitive data exposure.

Recommendations: For versions prior to 3.0.0-1.ova, update to PMM2 version 2.42.0-1.ova or later, such as 2.43.0-1.ova, 2.43.1-1.ova, 2.43.2-1.ova, or 2.44.0-1.ova, or update to PMM3 version 3.0.0-1.ova or later to resolve the issue.

Fix

Weakness Enumeration

CWE-1393

Related Identifiers

CVE-2025-26701

Affected Products

Percona Pmm Server

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-26701 · Security Note
• https://t.me/pentestingnews/57926 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1900726271073808495 · Twitter Post
• https://percona.com/blog/security-advisory-cve-affecting-percona-monitoring-and-management-pmm · Note
• https://t.me/cvetracker/18963 · Telegram Post
• https://t.me/purp_sec/380 · Telegram Post
• https://twitter.com/absholi7ly/status/1901465521968550126 · Twitter Post
• https://t.me/cvedetector/20145 · Telegram Post
• https://twitter.com/HunterMapping/status/1901464192672202772 · Twitter Post
• https://twitter.com/absholi7ly/status/1900738595796750571 · Twitter Post
• https://twitter.com/CVEnew/status/1899518288901857309 · Twitter Post
• https://twitter.com/Dinosn/status/1900769670724014551 · Twitter Post
• https://twitter.com/fofabot/status/1901599033267040633 · Twitter Post