The vulnerability CVE-2026-16527 affects the Performance Co-Pilot (PCP) pmproxy service in Red Hat Enterprise Linux 8. An unauthenticated remote attacker can bypass pmcd access controls by sending specially crafted requests to the /store endpoint of pmproxy. This allows the attacker to overwrite any Performance Metrics Domain Agent (PMDA) metric, potentially leading to arbitrary code execution and system takeover. The flaw is due to missing authentication for a critical function (CWE-306). Red Hat has released security updates (pcp-5.3.7-22.el8_10.5 and related packages) that fix this issue. The vendor advisory recommends restricting network access to port 44322/TCP to trusted hosts or disabling the pmproxy service if it is not needed. The vulnerability has a CVSS v3.1 score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), reflecting network attack vector, low complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

An unauthenticated remote attacker can bypass access controls on the pmproxy /store endpoint, allowing overwriting of PMDA metrics. This can lead to arbitrary code execution and complete system takeover if the pmproxy service is running and reachable. The impact includes potential compromise of system integrity, confidentiality, and availability.

Red Hat recommends restricting network access to the pmproxy service (TCP port 44322) to trusted hosts using firewall rules. If pmproxy functionality is not required, the service should be disabled by running 'sudo systemctl stop pmproxy' and 'sudo systemctl disable pmproxy'. Applying the official security update pcp-5.3.7-22.el8_10.5 or later will address this vulnerability. Users should follow the Red Hat advisory instructions to apply the update. Patch status: An official fix is available from Red Hat.