CVE-2026-16527

Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated Remote Code Execution in PCP pmproxy

Publication date: 2026-07-30

Last updated on: 2026-08-18

Assigner: redhat-SADP

Description

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-16527

EUVD

EUVD-2026-50976

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	performance_co_pilot	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

CVE-2026-16527 is an unauthenticated remote code execution vulnerability in the Performance Co-Pilot (PCP) pmproxy component. It allows attackers to bypass access controls by sending crafted requests to the /store endpoint, enabling them to overwrite any PMDA metric without authentication.

Detection Guidance

Check if PCP pmproxy is running on port 44322 using netstat or ss. Inspect pmproxy logs for unauthorized /store endpoint access attempts. Verify if the linux_sockets PMDA is loaded. Use curl to test the /store endpoint for unauthenticated writes: curl -X POST http://<target>:44322/store -d 'metric=value'.

Impact Analysis

An attacker could exploit this to execute arbitrary code on the system, potentially taking full control. This requires pmproxy to be running on port 44322, pmcd running, and the linux_sockets PMDA loaded. The attack is remote and does not need user interaction.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating confidentiality requirements in GDPR and HIPAA. Organizations using PCP may face compliance failures due to insufficient access controls.

Mitigation Strategies

Disable the /store endpoint in pmproxy configuration. Update PCP to the latest patched version. Restrict network access to pmproxy port 44322 via firewall rules. Monitor for suspicious activity targeting the /store endpoint.

Hi! I’m here to help you understand CVE-2026-16527. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70