CVE-2026-16531
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to denial of service.
Risk Assessment
An attacker can crash the pmproxy service or fill the filesystem, leading to unavailability of performance monitoring.
Recommendation
Update PCP to the latest patched version. Restrict access to the pmproxy logger servlet to trusted hosts only.
Other vulnerabilities in Performance Co-Pilot (PCP)
Original NVD description (English source)
An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS