# CVE-2026-30808: Artica Pandora FMS session fixation

Source: https://junglewise.ai/threats/cve-2026-30808-artica-pandora-fms-session-fixation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-30808 · Severity: high · CVSS 8.1 · Published 2026-05-12

A security vulnerability has been identified in Pandora FMS, a monitoring platform used to oversee IT infrastructure and networks. An attacker can trick a user into using a specific session ID, allowing the attacker to hijack the user's session once they log in. This could lead to unauthorized access to the monitoring dashboard, potentially exposing sensitive infrastructure data or allowing the attacker to modify system configurations.

## Quick answers

**Is CVE-2026-30808 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-30808 being exploited in the wild.

**How severe is CVE-2026-30808?** High severity, with a CVSS score of 8.1, published 12 May 2026.

**Which products and versions are affected?** Artica PFMS Pandora FMS 777 through 800.

**Is there a fix for CVE-2026-30808?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-30808 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-30808?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A session fixation vulnerability (CWE-384) exists in Pandora FMS versions 777 through 800. The application fails to invalidate or renew the session ID upon user authentication, allowing an attacker to provide a crafted session ID to a victim. If the victim subsequently authenticates using that ID, the attacker can hijack the active session. This attack typically requires some user interaction (e.g., clicking a link containing the pre-set session ID) but does not require prior authentication by the attacker. Successful exploitation grants the attacker the same privileges as the hijacked user. The issue is addressed in versions 777.17 and 802.

## Affected products

- Artica PFMS Pandora FMS 777 through 800

## Timeline

- 2026-05-12: disclosed
- 2026-05-12: advisory

## References

- [https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/](https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/)