{"id":421576,"date":"2026-04-28T12:07:13","date_gmt":"2026-04-28T12:07:13","guid":{"rendered":"https:\/\/pandorafms.com\/?p=421576"},"modified":"2026-04-28T12:07:13","modified_gmt":"2026-04-28T12:07:13","slug":"777-17","status":"publish","type":"post","link":"https:\/\/pandorafms.com\/en\/patch-notes\/777-17\/","title":{"rendered":"777.17 LTS"},"content":{"rendered":"

[et_pb_section fb_built=”1″ _builder_version=”4.22.0″ _module_preset=”default” custom_margin=”0px||||false|false” custom_padding=”0px||||false|false” global_colors_info=”{}”][et_pb_row _builder_version=”4.22.0″ _module_preset=”default” z_index=”0″ width=”100%” max_width=”900px” module_alignment=”left” custom_margin=”0px||0px||true|false” custom_padding=”0px||0px||true|false” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.21.0″ _module_preset=”default” global_colors_info=”{}”][et_pb_text admin_label=”Version” _builder_version=”4.27.5″ _module_preset=”default” custom_margin=”0px||||false|false” custom_padding=”0px||||false|false” locked=”off” global_colors_info=”{}”]<\/p>\n

Version: Pandora FMS 777 LTS<\/span><\/br>Release date: February 24, 2026<\/span><\/p>\n

[\/et_pb_text][et_pb_text admin_label=”Intro” module_id=”1″ _builder_version=”4.27.5″ _module_preset=”default” z_index=”0″ custom_margin=”0px||0px||true|false” custom_padding=”0px||0px||true|false” custom_css_main_element=”font-family:%22Pandora-Light%22;” locked=”off” global_colors_info=”{}”]<\/p>\n

LTS Patches<\/h2>\n

We only release patches for Long Time Support (LTS) versions, except for some particular cases where we do so for Feature Release (FR) versions.<\/p>\n

Security patches are developed as soon as possible after the vulnerability is detected. Patches for LTS versions usually include critical-bug troubleshooting and solutions to security problems.<\/p>\n

[\/et_pb_text][et_pb_divider color=”#eaeaea” divider_position=”center” divider_weight=”1px” admin_label=”=== SEPARADOR ===” module_id=”1″ _builder_version=”4.27.4″ _module_preset=”default” z_index=”0″ module_alignment=”center” custom_margin=”0px||0px||true|false” custom_padding=”25px||25px||true|false” border_color_all=”#eaeaea” locked=”off” global_colors_info=”{}”][\/et_pb_divider][et_pb_code admin_label=”Bug fixes” _builder_version=”4.27.5″ _module_preset=”default” z_index=”0″ custom_margin=”0px||0px||true|false” custom_padding=”0px||0px||true|false” locked=”off” global_colors_info=”{}”]<\/p>\n

Bug fixes<\/h2>\n

<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n
FIX LTS#<\/th>\n

<\/p>\n

GitLab#<\/th>\n

<\/p>\n

Description<\/th>\n

<\/tr>\n

<\/thead>\n

<\/p>\n

17919<\/pee><\/td>\n

<\/p>\n

14185, 17372<\/pee><\/td>\n

<\/p>\n

In Dashboards with event widgets, the visual style has been refined and now displays and maintains all elements in the same way.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

18079<\/pee><\/td>\n

<\/p>\n

17586<\/pee><\/td>\n

<\/p>\n

The process for saving NCM agents has been corrected.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

18267<\/pee><\/td>\n

<\/p>\n

17717<\/pee><\/td>\n

<\/p>\n

The display of IP addresses and MAC addresses has been fixed in the SNMP agent interfaces.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

18269<\/pee><\/td>\n

<\/p>\n

17495<\/pee><\/td>\n

<\/p>\n

The display of regular expressions in external monitoring policy alerts in the Web Console has been corrected.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

18270<\/pee><\/td>\n

<\/p>\n

17453<\/pee><\/td>\n

<\/p>\n

The filtering by alert status was corrected in the agent.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

18357<\/pee><\/td>\n

<\/p>\n

18348<\/pee><\/td>\n

<\/p>\n

In Command Center, Linked Visual Consoles, it has been corrected that when elements are disabled, they no longer affect higher levels.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

18525<\/pee><\/td>\n

<\/p>\n

18452<\/pee><\/td>\n

<\/p>\n

The monthly SLA report (PDF file) has been fixed for all languages other than English.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

18597<\/pee><\/td>\n

<\/p>\n

18596<\/pee><\/td>\n

<\/p>\n

Added exception routine for the \u201cData_in_files\u201d module of the PFMS self-monitoring agent.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

18780<\/pee><\/td>\n

<\/p>\n

14200<\/pee><\/td>\n

<\/p>\n

Corrected \u201cSelect All\u201d behavior for agents and modules in Mass Module Editing.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

18821, 19735<\/pee><\/td>\n

<\/p>\n

18820<\/pee><\/td>\n

<\/p>\n

Time thresholds applied to alerts through monitoring policies have been corrected.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

18883<\/pee><\/td>\n

<\/p>\n

18569<\/pee><\/td>\n

<\/p>\n

The \u201c_start_date_\u201d and \u201c_end_date_\u201d macros in reports were corrected to return the correct values.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

18887<\/pee><\/td>\n

<\/p>\n

18851<\/pee><\/td>\n

<\/p>\n

Fixed module event report.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

19084<\/pee><\/td>\n

<\/p>\n

18042<\/pee><\/td>\n

<\/p>\n

The count of agents for license purposes has been corrected.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

19085<\/pee><\/td>\n

<\/p>\n

14333, 19046<\/pee><\/td>\n

<\/p>\n

In the bulk editing of modules, the display of agents whose modules were selected first has been fixed.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

19100<\/pee><\/td>\n

<\/p>\n

18040<\/pee><\/td>\n

<\/p>\n

In event alerts, rule applications whose conditions include tag values have been fixed.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

19543<\/pee><\/td>\n

<\/p>\n

18191<\/pee><\/td>\n

<\/p>\n

Fixed the inclusion of IP addresses when creating modules using the SNMP interface wizard.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

19556<\/pee><\/td>\n

<\/p>\n

16132<\/pee><\/td>\n

<\/p>\n

The creation of users and their logins in the Web Console have been fixed when SAML (user ID attribute field) is used as the authentication method in Pandora FMS.<\/pee><\/td>\n

<\/tr>\n

<\/tbody>\n

<\/table>\n

[\/et_pb_code][et_pb_divider color=”#eaeaea” divider_position=”center” divider_weight=”1px” admin_label=”=== SEPARADOR ===” module_id=”2″ _builder_version=”4.27.4″ _module_preset=”default” z_index=”0″ module_alignment=”center” custom_margin=”0px||0px||true|false” custom_padding=”25px||25px||true|false” border_color_all=”#eaeaea” locked=”off” global_colors_info=”{}”][\/et_pb_divider][et_pb_code admin_label=”Improvements and small changes” _builder_version=”4.27.5″ _module_preset=”default” z_index=”0″ custom_margin=”0px||0px||true|false” custom_padding=”0px||0px||true|false” locked=”off” global_colors_info=”{}”]<\/p>\n

Improvements and small changes<\/h2>\n

<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n
FIX LTS#<\/th>\n

<\/p>\n

GitLab#<\/th>\n

<\/p>\n

Description<\/th>\n

<\/tr>\n

<\/thead>\n

<\/p>\n

18268<\/pee><\/td>\n

<\/p>\n

16083<\/pee><\/td>\n

<\/p>\n

In string-type modules, their display has been improved by the Web Console, taking into account whether the check result has more than 200 characters and whether it contains line breaks.<\/pee><\/td>\n

<\/tr>\n

<\/tbody>\n

<\/table>\n

[\/et_pb_code][et_pb_divider color=”#eaeaea” divider_position=”center” divider_weight=”1px” admin_label=”=== SEPARADOR ===” module_id=”2″ _builder_version=”4.27.4″ _module_preset=”default” z_index=”0″ module_alignment=”center” custom_margin=”0px||0px||true|false” custom_padding=”25px||25px||true|false” border_color_all=”#eaeaea” locked=”off” global_colors_info=”{}”][\/et_pb_divider][et_pb_code admin_label=”Known Changes and Limitations” _builder_version=”4.27.5″ _module_preset=”default” z_index=”0″ custom_margin=”0px||0px||true|false” custom_padding=”0px||0px||true|false” locked=”off” global_colors_info=”{}”]<\/p>\n

Known Changes and Limitations<\/h2>\n

<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n
FIX LTS#<\/th>\n

<\/p>\n

GitLab#<\/th>\n

<\/p>\n

Description<\/th>\n

<\/tr>\n

<\/thead>\n

<\/p>\n

18342 (23301, 23343)<\/pee><\/td>\n

<\/p>\n

N\/A<\/pee><\/td>\n

<\/p>\n

The links to the old PFMS library have been replaced with a new notice directing users to the new website.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

18696<\/pee><\/td>\n

<\/p>\n

18695<\/pee><\/td>\n

<\/p>\n

The \u201cAllow non-consecutive patches\u201d token being disabled also allows you to upgrade to the next LTS version.<\/pee><\/td>\n

<\/tr>\n

<\/tbody>\n

<\/table>\n

[\/et_pb_code][et_pb_divider color=”#eaeaea” divider_position=”center” divider_weight=”1px” admin_label=”=== SEPARADOR ===” module_id=”2″ _builder_version=”4.27.4″ _module_preset=”default” z_index=”0″ module_alignment=”center” custom_margin=”0px||0px||true|false” custom_padding=”25px||25px||true|false” border_color_all=”#eaeaea” locked=”off” global_colors_info=”{}”][\/et_pb_divider][et_pb_code admin_label=”Fixed vulnerabilities” _builder_version=”4.27.5″ _module_preset=”default” z_index=”0″ custom_margin=”0px||0px||true|false” custom_padding=”0px||0px||true|false” locked=”off” global_colors_info=”{}”]<\/p>\n

Fixed vulnerabilities<\/h2>\n

See our Common Vulnerabilities and Exposures (CVE\u00ae)<\/a> list.<\/pee><\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n
FIX LTS#<\/th>\n

<\/p>\n

GitLab#<\/th>\n

<\/p>\n

Description<\/th>\n

<\/tr>\n

<\/thead>\n

<\/p>\n

19199<\/pee>CVE-2026-34188<\/pee>Special thanks to: Pedro J. N\u00fa\u00f1ez-Cacho Fuentes<\/pee><\/td>\n

<\/p>\n

19178<\/pee><\/td>\n

<\/p>\n

The arbitrary SQL injection vulnerability involving access to custom event responses has been fixed.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

19200<\/pee>CVE-2026-34187<\/pee>Special thanks to: Pedro J. N\u00fa\u00f1ez-Cacho Fuentes<\/pee><\/td>\n

<\/p>\n

19177<\/pee><\/td>\n

<\/p>\n

Numeric variable types were updated to prevent SQL injection in AJAX.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

19201<\/pee>CVE-2026-34186<\/pee>Special thanks to: Pedro J. N\u00fa\u00f1ez-Cacho Fuentes<\/pee><\/td>\n

<\/p>\n

19176<\/pee><\/td>\n

<\/p>\n

The arbitrary SQL injection vulnerability involving access to custom agent fields has been fixed.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

19202<\/pee>CVE-2026-30813<\/pee>Special thanks to: Pedro J. N\u00fa\u00f1ez-Cacho Fuentes<\/pee><\/td>\n

<\/p>\n

19174<\/pee><\/td>\n

<\/p>\n

A vulnerability involving the injection of arbitrary SQL code through access to and queries of modules in the Dashboards feature has been fixed.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

19203<\/pee>CVE-2026-30812<\/pee>Special thanks to: Pedro J. N\u00fa\u00f1ez-Cacho Fuentes<\/pee><\/td>\n

<\/p>\n

19173<\/pee><\/td>\n

<\/p>\n

A vulnerability involving unauthorized code injection via event comments (XSS) has been fixed.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

19204<\/pee>CVE-2026-30811<\/pee>Special thanks to: Pedro J. N\u00fa\u00f1ez-Cacho Fuentes<\/pee><\/td>\n

<\/p>\n

19172<\/pee><\/td>\n

<\/p>\n

The leftover files and functions from discontinued features\u2014which had allowed access to important and sensitive information\u2014were permanently deleted.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

19205<\/pee>CVE-2026-30810<\/pee>Special thanks to: Pedro J. N\u00fa\u00f1ez-Cacho Fuentes<\/pee><\/td>\n

<\/p>\n

19171<\/pee><\/td>\n

<\/p>\n

The ability to execute PFMS 1.0 API commands via the web console was restricted to superadmin<\/i> users (additional security measures were also implemented).<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

19206<\/pee>CVE-2026-30809<\/pee>Special thanks to: Pedro J. N\u00fa\u00f1ez-Cacho Fuentes<\/pee><\/td>\n

<\/p>\n

19170<\/pee><\/td>\n

<\/p>\n

Fixed a command injection vulnerability in web module debugging.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

19207<\/pee>CVE-2026-30808<\/pee>Special thanks to: Pedro J. N\u00fa\u00f1ez-Cacho Fuentes<\/pee><\/td>\n

<\/p>\n

19169<\/pee>Related: 26, 14673<\/pee><\/td>\n

<\/p>\n

Added regeneration of the PHPSESSID cookie<\/i> after a user successfully logs in to the PFMS Web Console.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

19208<\/pee>CVE-2026-30807<\/pee>Special thanks to: Pedro J. N\u00fa\u00f1ez-Cacho Fuentes<\/pee><\/td>\n

<\/p>\n

19168, 19163<\/pee><\/td>\n

<\/p>\n

Fixed CSRF validation on PFMS Web Console extension pages.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

19209<\/pee>CVE-2026-30806<\/pee>Special thanks to: Pedro J. N\u00fa\u00f1ez-Cacho Fuentes<\/pee><\/td>\n

<\/p>\n

19167<\/pee><\/td>\n

<\/p>\n

The command injection via WHOIS<\/strong> into the operating system has been fixed.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

19211<\/pee>CVE-2026-30805<\/pee>Special thanks to: Pedro J. N\u00fa\u00f1ez-Cacho Fuentes<\/pee><\/td>\n

<\/p>\n

19166, 19740<\/pee><\/td>\n

<\/p>\n

Random password generation has been added to the PFMS API upon installation. For existing installations, a persistent warning has been added until the password is changed.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

19212<\/pee>CVE-2026-30804<\/pee>Special thanks to: Pedro J. N\u00fa\u00f1ez-Cacho Fuentes<\/pee><\/td>\n

<\/p>\n

19163<\/pee><\/td>\n

<\/p>\n

Registration, integration and validation of extensions for the PFMS Web Console are fixed.<\/pee><\/td>\n

<\/tr>\n

<\/p>\n

19213<\/pee><\/td>\n

<\/p>\n

18688<\/pee><\/td>\n

<\/p>\n

The search for text strings in custom fields (such as password fields) has been removed.<\/pee><\/td>\n

<\/tr>\n

<\/tbody>\n

<\/table>\n

[\/et_pb_code][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"

Version: Pandora FMS 777 LTSRelease date: February 24, 2026LTS Patches We only release patches for Long Time Support (LTS) versions, except for some particular cases where we do so for Feature Release (FR) versions. Security patches are developed as soon as possible after the vulnerability is detected. Patches for LTS versions usually include critical-bug troubleshooting […]<\/p>\n","protected":false},"author":33,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","_joinchat":[],"footnotes":""},"categories":[3416],"tags":[],"class_list":["post-421576","post","type-post","status-publish","format-standard","hentry","category-patch-notes"],"_links":{"self":[{"href":"https:\/\/pandorafms.com\/en\/wp-json\/wp\/v2\/posts\/421576","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pandorafms.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pandorafms.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pandorafms.com\/en\/wp-json\/wp\/v2\/users\/33"}],"replies":[{"embeddable":true,"href":"https:\/\/pandorafms.com\/en\/wp-json\/wp\/v2\/comments?post=421576"}],"version-history":[{"count":4,"href":"https:\/\/pandorafms.com\/en\/wp-json\/wp\/v2\/posts\/421576\/revisions"}],"predecessor-version":[{"id":421595,"href":"https:\/\/pandorafms.com\/en\/wp-json\/wp\/v2\/posts\/421576\/revisions\/421595"}],"wp:attachment":[{"href":"https:\/\/pandorafms.com\/en\/wp-json\/wp\/v2\/media?parent=421576"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pandorafms.com\/en\/wp-json\/wp\/v2\/categories?post=421576"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pandorafms.com\/en\/wp-json\/wp\/v2\/tags?post=421576"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}