Proxmox published an advisory revealing a vulnerability affecting only Proxmox VE version 7, which has not been supported for a couple of years. Since the disclosure, there has been a noticeable increase in scanning and brute force attempts targeting Proxmox servers, especially on port 8006. Attackers are attempting to authenticate via the /api2/json/access/ticket and /api2/extjs/access/ticket endpoints, with failed login attempts logged as HTTP 401 or 308 status codes. The 308 status code indicates a redirect allowing method change, which can occur if the attacker initially sends a non-TLS POST request. The vulnerability and associated scanning activity appear limited to the unsupported version 7 of Proxmox VE.

The vulnerability affects only Proxmox VE version 7, which is no longer supported. The increased scanning and brute force attempts could lead to unauthorized access if the vulnerability is successfully exploited on vulnerable systems. However, no active exploits in the wild have been confirmed. Systems running unsupported versions remain at risk if exposed to the internet without additional protections.

Since Proxmox VE version 7 is no longer supported, users should upgrade to a supported version of Proxmox VE to eliminate exposure to this vulnerability. Systems still running version 7 should be isolated from untrusted networks or have additional access controls to prevent unauthorized access. Monitoring for brute force attempts and blocking suspicious IPs may reduce risk. Patch status is not confirmed in the provided data; users should consult the official Proxmox advisory for current remediation guidance.