CVE-2024-26289: Remote Code Inclusion Vulnerability in Multiple PMB Versions

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-27 · updated 2026-06-17
Weakness: CWE-502

Description

Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7.5.6-2, from 7.4.1 before 7.4.9, from 7.3.1 before 7.3.18.

Affected products

SIGB PMB: from 7.3.1 before 7.3.18; from 7.4.1 before 7.4.9; from 7.5.1 before 7.5.6-2 — fixed in 7.3.18, 7.4.9, 7.5.6-2

How to fix

Upgrade to a fixed version: SIGB PMB 7.3.18, 7.4.9, 7.5.6-2. Check the vendor advisory for mitigations.

References

https://forge.sigb.net/projects/pmb/files
https://github.com/enisaeu/CNW/blob/main/advisories/2024/CNW-2024-A-12.md
https://forge.sigb.net/projects/pmb/files
https://github.com/enisaeu/CNW/blob/main/advisories/2024/CNW-2024-A-12.md

Get alerted when CVE-2024-26289 or the next vulnerability affects your stack