CVE-2026-16531

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.

Moderate: The pmproxy logger servlet in PCP is susceptible to a path traversal vulnerability, enabling an unauthenticated remote attacker to create arbitrary files and directories. This can lead to a denial of service or other impacts on systems where pmproxy is exposed on TCP port 44322, as the logger servlet is unconditionally active.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict network access to TCP port 44322, which is used by the pmproxy service. This can be achieved by configuring a firewall to block incoming connections to this port. Alternatively, if the pmproxy service is not essential for your environment, it can be disabled.

To disable the pmproxy service: sudo systemctl stop pmproxy sudo systemctl disable pmproxy

Warning: Disabling pmproxy may impact the functionality of Performance Co-Pilot components that rely on it for data collection and logging.