Critical Command Injection and DoS Vulnerabilities in openSUSE pcp

Recent updates for openSUSE's pcp software have addressed multiple critical vulnerabilities, including command injection and denial-of-service (DoS) issues. The vulnerabilities, identified as CVE-2026-16524, CVE-2026-16526, CVE-2026-16527, CVE-2026-16529, CVE-2026-16530, and CVE-2026-16531, affect various SUSE Linux Enterprise and openSUSE versions. Attack vectors include command injection through PMDA configurations and missing authentication flags in the pmproxy REST API. The vulnerabilities could lead to privilege escalation, permanent DoS, and unauthorized access to sensitive data. Patches have been released, and users are urged to update their systems immediately. The vulnerabilities were disclosed on July 30, 2026, and have been rated critical due to their potential impact on system integrity and availability.

Key Points: • Multiple critical vulnerabilities in openSUSE pcp were disclosed on July 30, 2026. • Affected CVEs include command injection and DoS vulnerabilities, posing severe risks to system security. • Users are advised to apply patches immediately to mitigate the risks associated with these vulnerabilities.