CVE-2026-34190: CSRF in Alert Command Deletion

Published Oct 1, 2026

Updated

Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards.

Affected Software

1 affected component

Pandora FMS Pandora FMS>=777

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Pandora FMS to a version that resolves this vulnerability.
Fixed in v800.5
Upgrade
Upgrade Pandora FMS to a version that resolves this vulnerability.
Fixed in v805

Event History

Oct 1, 2026

CVE Published

via MITRE·09:26 AM

Data Sourced

via MITRE·09:26 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Pandora FMS deployments from version 777 onwards are affected when an administrator is authenticated and can be induced to visit a malicious page.

What does an attacker need to exploit it?

The attacker needs an authenticated administrator to visit a malicious page. Exploitation relies on sequential GET requests that are not validated.

What is the likely impact of successful exploitation?

Successful exploitation allows unauthorized deletion of alert commands.