Affected: AlmaLinux:8: pcp-conf, AlmaLinux:8: pcp-devel, AlmaLinux:8: pcp-doc, AlmaLinux:8: pcp-export-pcp2elasticsearch, AlmaLinux:8: pcp-export-pcp2graphite, AlmaLinux:8: pcp-export-pcp2influxdb, AlmaLinux:8: pcp-export-pcp2json, AlmaLinux:8: pcp-export-pcp2spark, AlmaLinux:8: pcp-export-pcp2xml, AlmaLinux:8: pcp-export-pcp2zabbix and 68 more

Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems.

Security Fix(es):

* PCP: PCP linux_sockets PMDA: Arbitrary Command Execution via Command Injection (CVE-2026-16524) * PCP: PCP: Privilege escalation to root via linux_sockets PMDA vulnerability (CVE-2026-16526) * PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules (CVE-2026-16527) * PCP: PCP: Denial of Service due to signed integer overflow (CVE-2026-16529)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.

Affected: openEuler:22.03-LTS-SP4: pcp

Performance Co-Pilot (PCP) provides a framework and services to support system-level performance monitoring and performance management. Security Fix(es):

A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.(CVE-2026-16524)

A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.(CVE-2026-16526)

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.(CVE-2026-16527)

A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.(CVE-2026-16529)

libpcp-devel-6.3.8-3.1 on GA media

PCP: PCP linux_sockets PMDA: Arbitrary Command Execution via Command Injection PCP: PCP: Privilege escalation to root via linux_sockets PMDA vulnerability PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules PCP: PCP: Denial of Service due to signed integer overflow

Affected: Rocky Linux:8: pcp

Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems.

Security Fix(es):

* PCP: PCP linux_sockets PMDA: Arbitrary Command Execution via Command Injection (CVE-2026-16524)

* PCP: PCP: Privilege escalation to root via linux_sockets PMDA vulnerability (CVE-2026-16526)

* PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules (CVE-2026-16527)

* PCP: PCP: Denial of Service due to signed integer overflow (CVE-2026-16529)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Security update for pcp

Affected: Ubuntu:16.04:LTS: pcp, Ubuntu:18.04:LTS: pcp, Ubuntu:20.04:LTS: pcp, Ubuntu:22.04:LTS: pcp, Ubuntu:24.04:LTS: pcp, Ubuntu:26.04:LTS: pcp

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.

Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux (pcp) ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um Sicherheitsvorkehrungen zu umgehen, und um einen Denial of Service Angriff durchzuführen.