CVE-2025-26701: Percona Monitoring And Management

Critical severity, CVSS 10.0. EPSS: 0.5% chance of exploitation in the next 30 days.

An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can lead to SSH access, use of Sudo to root, and sensitive data exposure. This is fixed in PMM2 2.42.0-1.ova, 2.43.0-1.ova, 2.43.1-1.ova, 2.43.2-1.ova, and 2.44.0-1.ova and in PMM3 3.0.0-1.ova and later.

Affected products

• Percona Monitoring And Management: from 2.38, before 2.42.0-1.ova (fixed in 2.42.0-1.ova); from 2.43.0, before 2.43.0-1.ova (fixed in 2.43.0-1.ova); from 2.43.1, before 2.43.1-1.ova (fixed in 2.43.1-1.ova); from 2.43.2, before 2.43.2-1.ova (fixed in 2.43.2-1.ova); from 2.44.0, before 2.44.0-1.ova (fixed in 2.44.0-1.ova); from 3.0.0, before 3.0.0-1.ova (fixed in 3.0.0-1.ova)

Published 2025-03-11. Last modified 2026-06-17.