Proxmox vulnerabilities and fixes

CVEs that mention Proxmox, ranked by priority. 4 tracked.

Proxmox has 4 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-09-21. Highest priority: CVE-2023-54391 (score 64/100).

• CVE-2023-54391 CRITICAL 9.8 Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-acc
• CVE-2026-25199 CRITICAL 9.1 UPGRADE Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants
• CVE-2026-45694 MEDIUM 5.4 LibreNMS is a network monitoring system
• CVE-2026-94588 MEDIUM 4.4 In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionalit

FAQ

How do I fix Proxmox vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Proxmox being exploited right now?

None of the tracked Proxmox CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Proxmox CVE should I patch first?

CVE-2023-54391 currently ranks highest (64/100): Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-acc.

RSS feed for Proxmox · ← Back to latest CVEs