Read the docs
TI-2026-13790 Aliases CVE-2026-16526GHSA-534w-2xfq-h655

Pcp: pcp: privilege escalation to root via linux_sockets pmda vulnerability

Priority MEDIUM 41CWE-403Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 15 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0057 47th percentileScored 2026-11-07
Fix Partial Red Hat: 10 advisoriesRed Hat: 15 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Enterprise Linux 10—7.0.3-5.el10_2Patch availableCNA
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—6.3.7-1.el10_0.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8—5.3.7-22.el8_10.5Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—5.2.5-8.el8_4.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On—5.2.5-8.el8_4.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—5.3.5-10.el8_6.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On—5.3.5-10.el8_6.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—5.3.7-19.el8_8.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—5.3.7-19.el8_8.1Patch availableCNA
Red HatRed Hat Enterprise Linux 9—6.3.7-8.el9_8.4Patch availableCNA
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—6.0.1-8.el9_2.2Patch availableCNA
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—6.2.0-5.el9_4.2Patch availableCNA
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—6.3.7-1.el9_6.1Patch availableCNA
Red HatRed Hat Enterprise Linux 6——No fix listedCNA
Red HatRed Hat Enterprise Linux 7——No fix listedCNA
Red HatRed Hat OpenShift Container Platform 4——Not affectedCNA
Red HatRed Hat OpenShift Container Platform 5——Not affectedCNA
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 7.0.3-5.el10_2 Patch available CNA
  • Red Hat Enterprise Linux 10.0 Extended Update Support VendorRed Hat Affected — Fixed in 6.3.7-1.el10_0.1 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 5.3.7-22.el8_10.5 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 5.2.5-8.el8_4.1 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On VendorRed Hat Affected — Fixed in 5.2.5-8.el8_4.1 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 5.3.5-10.el8_6.1 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On VendorRed Hat Affected — Fixed in 5.3.5-10.el8_6.1 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Telecommunications Update Service VendorRed Hat Affected — Fixed in 5.3.7-19.el8_8.1 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 5.3.7-19.el8_8.1 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 6.3.7-8.el9_8.4 Patch available CNA
  • Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 6.0.1-8.el9_2.2 Patch available CNA
  • Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 6.2.0-5.el9_4.2 Patch available CNA
  • Red Hat Enterprise Linux 9.6 Extended Update Support VendorRed Hat Affected — Fixed in 6.3.7-1.el9_6.1 Patch available CNA
  • Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat OpenShift Container Platform 5 VendorRed Hat Affected — Fixed in — Not affected CNA

CPE names CNA · 17

CPEVersionsRoleVendor
cpe:/o:redhat:enterprise_linux:10.210.2—Red Hat
cpe:/o:redhat:enterprise_linux_eus:10.010.0—Red Hat
cpe:/a:redhat:enterprise_linux:8::appstream8—Red Hat
cpe:/a:redhat:rhel_aus:8.4::appstream8.4—Red Hat
cpe:/a:redhat:rhel_eus_long_life:8.4::appstream8.4—Red Hat
cpe:/a:redhat:rhel_aus:8.6::appstream8.6—Red Hat
cpe:/a:redhat:rhel_eus_long_life:8.6::appstream8.6—Red Hat
cpe:/a:redhat:rhel_e4s:8.8::appstream8.8—Red Hat
cpe:/a:redhat:rhel_tus:8.8::appstream8.8—Red Hat
cpe:/a:redhat:enterprise_linux:9::appstream9—Red Hat
  • cpe:/o:redhat:enterprise_linux:10.2 Versions 10.2 — ·Red Hat
  • cpe:/o:redhat:enterprise_linux_eus:10.0 Versions 10.0 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:8::appstream Versions 8 — ·Red Hat
  • cpe:/a:redhat:rhel_aus:8.4::appstream Versions 8.4 — ·Red Hat
  • cpe:/a:redhat:rhel_eus_long_life:8.4::appstream Versions 8.4 — ·Red Hat
  • cpe:/a:redhat:rhel_aus:8.6::appstream Versions 8.6 — ·Red Hat
  • cpe:/a:redhat:rhel_eus_long_life:8.6::appstream Versions 8.6 — ·Red Hat
  • cpe:/a:redhat:rhel_e4s:8.8::appstream Versions 8.8 — ·Red Hat
  • cpe:/a:redhat:rhel_tus:8.8::appstream Versions 8.8 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
Show 7 more CPE
CPEVersionsRoleVendor
cpe:/a:redhat:rhel_e4s:9.2::appstream9.2—Red Hat
cpe:/a:redhat:rhel_e4s:9.4::appstream9.4—Red Hat
cpe:/a:redhat:rhel_eus:9.6::appstream9.6—Red Hat
cpe:/o:redhat:rhel_els:66—Red Hat
cpe:/o:redhat:rhel_els:77—Red Hat
cpe:/a:redhat:openshift:44—Red Hat
cpe:/a:redhat:openshift:55—Red Hat
  • cpe:/a:redhat:rhel_e4s:9.2::appstream Versions 9.2 — ·Red Hat
  • cpe:/a:redhat:rhel_e4s:9.4::appstream Versions 9.4 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:9.6::appstream Versions 9.6 — ·Red Hat
  • cpe:/o:redhat:rhel_els:6 Versions 6 — ·Red Hat
  • cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat
  • cpe:/a:redhat:openshift:4 Versions 4 — ·Red Hat
  • cpe:/a:redhat:openshift:5 Versions 5 — ·Red Hat

Remediation

Red Hat 10 advisories

  • RHSA-2026:74613 Released 2026-10-01 · Red Hat rating Important
    pcp security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) pcp-5.2.5-8.el8_4.1, pcp-conf-5.2.5-8.el8_4.1, pcp-devel-5.2.5-8.el8_4.1 +47
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) pcp-5.2.5-8.el8_4.1, pcp-conf-5.2.5-8.el8_4.1, pcp-devel-5.2.5-8.el8_4.1 +47
  • RHSA-2026:74612 Released 2026-10-01 · Red Hat rating Important
    pcp security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) pcp-5.3.5-10.el8_6.1, pcp-conf-5.3.5-10.el8_6.1, pcp-devel-5.3.5-10.el8_6.1 +47
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) pcp-5.3.5-10.el8_6.1, pcp-conf-5.3.5-10.el8_6.1, pcp-devel-5.3.5-10.el8_6.1 +47
  • RHSA-2026:73767 Released 2026-09-30 · Red Hat rating Important
    pcp security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) pcp-5.3.7-19.el8_8.1, pcp-conf-5.3.7-19.el8_8.1, pcp-devel-5.3.7-19.el8_8.1 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) pcp-5.3.7-19.el8_8.1, pcp-conf-5.3.7-19.el8_8.1, pcp-devel-5.3.7-19.el8_8.1 +47
Show 7 more Red Hat advisories
  • RHSA-2026:72594 Released 2026-09-28 · Red Hat rating Important
    pcp security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) pcp-6.0.1-8.el9_2.2, pcp-conf-6.0.1-8.el9_2.2, pcp-devel-6.0.1-8.el9_2.2 +47
  • RHSA-2026:72593 Released 2026-09-28 · Red Hat rating Important
    pcp security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) pcp-6.2.0-5.el9_4.2, pcp-conf-6.2.0-5.el9_4.2, pcp-devel-6.2.0-5.el9_4.2 +47
  • RHSA-2026:72272 Released 2026-09-28 · Red Hat rating Important
    pcp security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) pcp-6.3.7-1.el9_6.1, pcp-conf-6.3.7-1.el9_6.1, pcp-devel-6.3.7-1.el9_6.1 +47
  • RHSA-2026:72273 Released 2026-09-28 · Red Hat rating Important
    pcp security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) pcp-6.3.7-1.el10_0.1, pcp-conf-6.3.7-1.el10_0.1, pcp-devel-6.3.7-1.el10_0.1 +47
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) pcp-pmda-bpf-6.3.7-1.el10_0.1, pcp-testsuite-6.3.7-1.el10_0.1
  • RHSA-2026:55617 Released 2026-08-17 · Red Hat rating Important
    pcp security update
    • Red Hat Enterprise Linux AppStream (v. 10) pcp-7.0.3-5.el10_2, pcp-conf-7.0.3-5.el10_2, pcp-devel-7.0.3-5.el10_2 +47
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) pcp-testsuite-7.0.3-5.el10_2
  • RHSA-2026:55740 Released 2026-08-17 · Red Hat rating Important
    pcp security update
    • Red Hat Enterprise Linux AppStream (v. 9) pcp-6.3.7-8.el9_8.4, pcp-conf-6.3.7-8.el9_8.4, pcp-devel-6.3.7-8.el9_8.4 +47
  • RHSA-2026:55560 Released 2026-08-17 · Red Hat rating Important
    pcp security update
    • Red Hat Enterprise Linux AppStream (v. 8) pcp-5.3.7-22.el8_10.5, pcp-conf-5.3.7-22.el8_10.5, pcp-devel-5.3.7-22.el8_10.5 +47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 15 more products — RHSA-2026:55560

    4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-13792 Pcp: pcp: denial of service due to signed integer overflowPriority LOW 39
    • TI-2026-13791 Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rulesPriority LOW 39
    • TI-2026-13789 Pcp: pcp linux_sockets pmda: arbitrary command execution via command injectionPriority LOW 37
    Show all 4 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 15 more products — RHSA-2026:55617

    4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-13792 Pcp: pcp: denial of service due to signed integer overflowPriority LOW 39
    • TI-2026-13791 Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rulesPriority LOW 39
    • TI-2026-13789 Pcp: pcp linux_sockets pmda: arbitrary command execution via command injectionPriority LOW 37
    Show all 4 records → Advisory →
Show 8 more groups
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 15 more products — RHSA-2026:55740

    4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-13792 Pcp: pcp: denial of service due to signed integer overflowPriority LOW 39
    • TI-2026-13791 Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rulesPriority LOW 39
    • TI-2026-13789 Pcp: pcp linux_sockets pmda: arbitrary command execution via command injectionPriority LOW 37
    Show all 4 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 15 more products — RHSA-2026:72272

    4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-13792 Pcp: pcp: denial of service due to signed integer overflowPriority LOW 39
    • TI-2026-13791 Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rulesPriority LOW 39
    • TI-2026-13789 Pcp: pcp linux_sockets pmda: arbitrary command execution via command injectionPriority LOW 37
    Show all 4 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 15 more products — RHSA-2026:72273

    4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-13792 Pcp: pcp: denial of service due to signed integer overflowPriority LOW 39
    • TI-2026-13791 Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rulesPriority LOW 39
    • TI-2026-13789 Pcp: pcp linux_sockets pmda: arbitrary command execution via command injectionPriority LOW 37
    Show all 4 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 15 more products — RHSA-2026:72593

    4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-13792 Pcp: pcp: denial of service due to signed integer overflowPriority LOW 39
    • TI-2026-13791 Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rulesPriority LOW 39
    • TI-2026-13789 Pcp: pcp linux_sockets pmda: arbitrary command execution via command injectionPriority LOW 37
    Show all 4 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 15 more products — RHSA-2026:72594

    4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-13792 Pcp: pcp: denial of service due to signed integer overflowPriority LOW 39
    • TI-2026-13791 Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rulesPriority LOW 39
    • TI-2026-13789 Pcp: pcp linux_sockets pmda: arbitrary command execution via command injectionPriority LOW 37
    Show all 4 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 15 more products — RHSA-2026:73767

    4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-13792 Pcp: pcp: denial of service due to signed integer overflowPriority LOW 39
    • TI-2026-13791 Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rulesPriority LOW 39
    • TI-2026-13789 Pcp: pcp linux_sockets pmda: arbitrary command execution via command injectionPriority LOW 37
    Show all 4 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 15 more products — RHSA-2026:74612

    4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-13792 Pcp: pcp: denial of service due to signed integer overflowPriority LOW 39
    • TI-2026-13791 Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rulesPriority LOW 39
    • TI-2026-13789 Pcp: pcp linux_sockets pmda: arbitrary command execution via command injectionPriority LOW 37
    Show all 4 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 15 more products — RHSA-2026:74613

    4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-13792 Pcp: pcp: denial of service due to signed integer overflowPriority LOW 39
    • TI-2026-13791 Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rulesPriority LOW 39
    • TI-2026-13789 Pcp: pcp linux_sockets pmda: arbitrary command execution via command injectionPriority LOW 37
    Show all 4 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:55617
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:55560
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:55740
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:74613
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:74612
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:73767
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:72594
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:72593
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:72273
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:72272
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:74613
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:74612
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:73767
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:55617
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:72273
Not affected: 2 products
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-16526
  2. 2026-10-03 Alias added: GHSA-534w-2xfq-h655
  3. 2026-11-04 Affected versions changed · CNA
  4. 2026-11-05 Affected versions changed · Red Hat

References

Advisory 10

Other 2

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences