CVE-2026-16524CWE-78command-injection

CVE-2026-16524

High · published July 30, 2026

CVSS v3.1
7.8
EPSS
1%
Percentile
52.7
In the wild
Unconfirmed
What it is

A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric.

This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00702 · 52.7th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-07-30T10:25Z
References (12)
https://access.redhat.com/errata/RHSA-2026:55560 · [email protected]https://access.redhat.com/errata/RHSA-2026:55617 · [email protected]https://access.redhat.com/errata/RHSA-2026:55740 · [email protected]https://access.redhat.com/errata/RHSA-2026:72272 · [email protected]https://access.redhat.com/errata/RHSA-2026:72273 · [email protected]https://access.redhat.com/errata/RHSA-2026:72593 · [email protected]https://access.redhat.com/errata/RHSA-2026:72594 · [email protected]https://access.redhat.com/errata/RHSA-2026:73767 · [email protected]https://access.redhat.com/errata/RHSA-2026:74612 · [email protected]https://access.redhat.com/errata/RHSA-2026:74613 · [email protected]https://access.redhat.com/security/cve/CVE-2026-16524 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2506023 · [email protected]
EPSS history
Timeline
  • 30 JUL 05:15Z
    Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection
    cvelistv5