CVE-2025-26701
Critical
Description
An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can lead to SSH access, use of Sudo to root, and sensitive data exposure. This is fixed in PMM2 2.42.0-1.ova, 2.43.0-1.ova, 2.43.1-1.ova, 2.43.2-1.ova, and 2.44.0-1.ova and in PMM3 3.0.0-1.ova and later.
SeverityCritical
CVSS10.0
Exploit probability—
Product
Monitoring and Management
PublishedMar 11, 2025
First seenMar 11, 2025
Weakness typeCWE-1393CWE-1393
How to fix
Update
- Percona Monitoring and Management2.42.0-1.ova, 2.43.0-1.ova, 2.43.1-1.ova, 2.43.2-1.ova, 2.44.0-1.ova, 3.0.0-1.ova or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Percona Monitoring and Management | 2.38 ≤ v < 2.42.0-1.ova, 2.43.0 ≤ v < 2.43.0-1.ova, 2.43.1 ≤ v < 2.43.1-1.ova, 2.43.2 ≤ v < 2.43.2-1.ova, 2.44.0 ≤ v < 2.44.0-1.ova, 3.0.0 ≤ v < 3.0.0-1.ova | 2.42.0-1.ova, 2.43.0-1.ova, 2.43.1-1.ova, 2.43.2-1.ova, 2.44.0-1.ova, 3.0.0-1.ova |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.