CVE-2026-16527

Name of the Vulnerable Software and Affected Versions PCP pmproxy (affected versions not specified)

Description An unauthenticated remote attacker can bypass access controls by sending crafted requests to the '/store' endpoint. This allows the attacker to overwrite any PMDA metric, which can lead to arbitrary code execution and full system takeover.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.