Forwarded from HAT's Public Channel | 🫪
HAT's Public Channel | 🫪
Update: 由于 PVE 7.x 已 EOL，因此对应版本的 Exploit 已提前发布（确认可完整绕过 WebUI 认证），8.x/9.x 则被作者声明为 “暂时不受影响” 无论如何，尽快参考 最佳实践 加固你所有对外开放的敏感服务！ Exp (.js) 正文: // PVE 7.4 auth-bypass @NebuSec 2026 // First, make sure to try logging in as root with this exact password: root@pam…
此漏洞已分配编号 PSA-2026-00043-1

确认受影响版本: >= 7.0-7 & <8.0.4 (截止今日均已 EOL), 仍然建议更新到 PVE 9

*如果你在 PVE WebUI 中配置了用户的 TFA，就不受此漏洞影响

https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-4#post-867929
Proxmox Support Forum
Proxmox Virtual Environment - Security Advisories
Subject: PSA-2026-00037-1: SCTPhantom Local Privilege Escalation issue

Advisory date: 2026-08-10

Packages: proxmox-kernel-*

Details:

A use-after-free issue in the Linux kernels SCTP code...