CVE-2026-34187 is a critical (CVSS 9.8) SQL injection in Artica Pandora FMS, versions 777 through 800, through a graph container parameter. The record does not name a fixed version, so check the vendor's security page and apply the update it lists.
What's affected
The record says the issue affects Pandora FMS from 777 through 800. The injection point is the graph container parameter.
The record points to the vendor's page of common vulnerabilities and exposures. That page did not load for me during review, so I cannot confirm the fixed build. Check the page directly and use the build it names.
Pandora FMS has had other recent CVEs, and the same security page lists them. Update to the newest release in your branch rather than a minimal fix, so you pick up all of them at once.
How to check if you're exposed
Open the Pandora FMS console and read the version in the footer or the About page. If you are on a build between 777 and 800, treat the system as affected.
Then see whether the console is reachable from untrusted networks. The vector shows network access with no privileges, so the main protection is limiting who can reach the web console in the first place.
Review the web server access logs for unusual requests to graph pages, and check the database for unexpected users.
What to do now
- Find your Pandora FMS version and compare it with the range from 777 through 800.
- Read the vendor's security page and apply the fixed build it lists.
- Restrict the web console to management networks or a VPN.
- Check for new or changed console users and for odd rows in the database.
- Rotate the credentials the monitoring server uses to reach other systems if you see signs of misuse.
- Make sure the database account used by Pandora FMS has only the rights it needs.
Why it matters
The weakness is CWE-89, SQL injection. A value from the graph container parameter reaches a database query without proper neutralization, so the database can read parts of it as commands.
Monitoring servers deserve more care than their reputation suggests. They store credentials and addresses for much of your estate, and they usually hold read access to many systems. An attacker with access to the monitoring database learns where everything is. The record does not mark this CVE as exploited and it is not on the CISA KEV list.
Quick check
Which version fixes this?
The record does not say. Check the vendor's security page for the fixed build and apply it.
Sources
Last reviewed: 19 October 2026.
