Loading story…
CVE-2023-54391 affects Proxmox Virtual Environment 7.0 through 8.0 where libpve-access-control is older than 8.0.4. An unauthenticated remote attacker can send an arbitrary tfa-challenge value to the API login endpoint and bypass password verification, authenticating as an enabled account that has no second factor configured, potentially including root@pam.
The flaw is rated critical in impact (CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and places exposed management interfaces on TCP port 8006 at risk of full administrative compromise and remote code execution through the platform. Reports alleged active compromises of Internet-exposed, end-of-life Proxmox VE 7 systems; organizations should urgently remove management interfaces from public exposure, upgrade to a fixed supported release, and investigate affected hosts for unauthorized access.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
A contributor submitted a Nuclei YAML template for an alleged Proxmox VE default-credentials issue with TFA bypass, including an HTTP request and matchers intended to identify the condition. The pull request was marked Done and Ready to merge, but did not provide a CVE, affected versions, vendor validation, or exploitation evidence.
A Reddit post alleged that end-of-life Proxmox VE releases from 7.0-7 through before 8.0.4 were being exploited through exposed TCP port 8006 and that numerous systems had been rooted that day. The supplied material provides no independent confirmation of the alleged compromises or their connection to SCTPhantom.
The CVE record was updated with details of an authentication bypass in Proxmox VE 7.0 through 8.0, affecting libpve-access-control versions before 8.0.4. An unauthenticated attacker could supply an arbitrary tfa-challenge value to bypass password verification and authenticate as an enabled user without a configured second factor, potentially including root@pam.
Proxmox advisory PSA-2026-00037-1 described SCTPhantom as a use-after-free vulnerability in proxmox-kernel packages that could enable local privilege escalation. The advisory does not establish that this issue was the alleged network-accessible authentication bypass.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
btcirt.bt
Open sourcegithub.com
Open sourcecvefeed.io
Open sourcereddit.com
Open sourceforum.proxmox.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed three vulnerabilities affecting **Proxmox Virtual Environment (PVE)** and **Proxmox Mail Gateway (PMG)**, including a post-authentication reflected XSS in PVE’s API Inspector, a CRLF injection flaw in HTTP error handling, and a post-authentication SSRF plus arbitrary file-read issue shared across both products. The XSS bug, tracked as `CVE-2022-31358`, could let an authenticated attacker run JavaScript in a logged-in administrator’s browser and potentially abuse exposed web UI functions to execute actions on the host. The CRLF injection issue could be exploited in Chromium-based browsers to inject headers and trigger a client-side denial of service by forcing oversized cookie headers that lock users out of the web interface. The most serious finding was a bug chain in PVE and PMG that allowed low-privileged authenticated users to abuse SSRF and arbitrary file read; in PMG, attackers could also access backup archives containing the authentication private key, forge valid tickets, and escalate privileges to **`root@pam`**. MITRE assigned `CVE-2022-35507` and `CVE-2022-35508` to the latter flaws. Proxmox addressed the XSS in **`pve-http-server` 4.1-2** and patched the CRLF injection and SSRF-related issues in **`pve-http-server` 4.1-3**.
Jun 29, 2026
German CERT published two advisories affecting **Proxmox Virtual Environment (PVE)**, including one issue that can lead to **information disclosure** and a later notice covering **multiple vulnerabilities** in the virtualization platform. The advisories, `2026-1012` and `2026-1243`, indicate that organizations running Proxmox should review exposed management infrastructure and assess whether sensitive data or administrative functions could be affected. The notices provide limited public detail, but the combination of an information disclosure flaw and additional unspecified weaknesses raises concern for enterprises using Proxmox to host virtual machines and manage clustered infrastructure. Security teams should identify all PVE deployments, monitor vendor and CERT updates for affected versions and patches, and prioritize remediation or compensating controls on internet-reachable or business-critical systems.
Jun 29, 2026
WebPros Plesk before version **18.0.80.1** is affected by **CVE-2026-64637**, an improper privilege management flaw in the **XML-RPC API** that allows an authenticated reseller to obtain an administrative session for the **root** user account. The vulnerability is classified as **CWE-269** and carries a high-severity **CVSS v3** vector of `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`, indicating low attack complexity and potentially severe impact on confidentiality, integrity, and availability. A related advisory from **CERT-PY** flagged the issue in Plesk products, reinforcing the risk to organizations that use the hosting control panel in multi-tenant or reseller environments. Available records indicate the flaw is not currently assessed as exploited in the wild and is not considered automatable, but its ability to let a lower-privileged authenticated user escalate directly to root-level administration makes prompt upgrading to **18.0.80.1** or later a priority.
Aug 8, 2026