THREAT OPS › Threat News › [NVD] CVE-2026-16527 (HIGH 7.3) — An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.
[NVD] CVE-2026-16527 (HIGH 7.3) — An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.
CVE-2026-16527 CVSS: 7.3 HIGH Published: 2026-07-30T06:25:02.813
An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.
Indicators of compromise
- CVE-2026-16527cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-16527