CVE-2026-16530

MediumCVSS 6.5

Published: 30/07/2026(UTC)Updated: 05/11/2026(UTC)Translated: 30/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.49%

42th percentile - higher than 42% of all known CVEs

Summary

A flaw in the PCP pmproxy service's pmLogLoadInDom() function allows a remote attacker to send a crafted request that bypasses a critical bounds check, causing a crash and potential memory information leak.

Risk Assessment

An attacker can cause a denial of service (DoS) and access sensitive data from system memory, compromising confidentiality.

Recommendation

Update PCP to the latest patched version. Restrict access to the pmproxy service to trusted networks only.

Other vulnerabilities in Performance Co-Pilot (PCP)

CVE-2026-16531Medium
An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to denial of service.

Original NVD description (English source)

A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the `pmproxy` service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS