This vulnerability allows an unauthenticated remote attacker to bypass access controls in the Performance Co-Pilot (PCP) pmproxy service by sending specially crafted requests to the /store endpoint. Exploitation enables the attacker to overwrite any Performance Metrics Domain Agent (PMDA) metric, which can lead to arbitrary code execution and complete system compromise on Red Hat Enterprise Linux 10. The CVSS 3.1 base score is 7.3, indicating high severity with network attack vector, no privileges required, and no user interaction needed. No patch or official remediation level is stated in the vendor advisory content provided.

Successful exploitation can result in arbitrary code execution and full system takeover on affected Red Hat Enterprise Linux 10 systems. The vulnerability is exploitable remotely without authentication, increasing the risk of compromise. Confidentiality, integrity, and availability impacts are all rated as low to high according to the CVSS vector, reflecting potential data exposure, modification, and service disruption.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-16527 for current remediation guidance. Until an official fix is available, restrict network access to the PCP pmproxy service and monitor for suspicious activity targeting the /store endpoint. Follow vendor instructions once patches or mitigations are released.