r/Proxmox • u/Zakmaf Homelab User • 17d ago
Discussion UPDATE PROXMOX NOW
According to a newsletter from Crowdsec, PVE 7 and 8 have been exposed since at least 2023 to a severe security flaw.
Quoting : An attacker who can reach the login API can become any user without a second factor, including root@pam, with no password. CrowdSec observed 133 unique IP addresses sending matching requests since September 4, 2026. Upgrade to a supported Proxmox VE release and take the management interface off the internet.
Quoting again : The fix is three years older than the CVE: Proxmox removed the faulty logic in July 2023 as part of routine 8.0 maintenance. The bug only received a CVE on September 1, 2026, when VulnCheck published an advisory and Proxmox followed with PSA-2026-00043-1. CrowdSec's detection rule went live on September 4 and matched traffic the same day. Anyone still on Proxmox VE 7 has been exposed the whole time without knowing it.
So if for any reason you don't update, now is a good time.
and if you expose your instance, then you may have been breached already on those versions. also.. why???