CVE-2025-26701

published 2025-03-11

CVE-2025-26701: An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can lead to SSH access, use of Sudo to root…

Priority P3 57 critical 10 CVSS 3.1

AV N AC L PR N UI N S C C H I H A H

An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can lead to SSH access, use of Sudo to root, and sensitive data exposure. This is fixed in PMM2 2.42.0-1.ova, 2.43.0-1.ova, 2.43.1-1.ova, 2.43.2-1.ova, and 2.44.0-1.ova and in PMM3 3.0.0-1.ova and later.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
percona	monitoring_and_management	>= 2.38 < 2.42.0-1.ova	2.42.0-1.ova
percona	monitoring_and_management	>= 2.43.0 < 2.43.0-1.ova	2.43.0-1.ova
percona	monitoring_and_management	>= 2.43.1 < 2.43.1-1.ova	2.43.1-1.ova
percona	monitoring_and_management	>= 2.43.2 < 2.43.2-1.ova	2.43.2-1.ova
percona	monitoring_and_management	>= 2.44.0 < 2.44.0-1.ova	2.44.0-1.ova
percona	monitoring_and_management	>= 3.0.0 < 3.0.0-1.ova	3.0.0-1.ova

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-1393