CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Called exploited the same day it was disclosed.
Measured from the CVE publication date to the earliest of 1 KEV catalogue that list it.
The life of this vulnerability
- CVE published
- First KEV listingsame day
- Last sighting1d
Gaps are compressed to equal steps. The elapsed time is printed under each.
Which catalogues call it exploited
- CISA KEVUS federaldoes not list it
- EUVDENISA, European Uniondoes not list it
- VulnCheck KEVcommercial researchlisted Sep 1, 2026
- CIRCLaggregator, mirrors the abovelisted Sep 1, 2026, not counted
This rests on a single catalogue. No second catalogue corroborates the claim that it is being exploited. CIRCL is an aggregator and is not counted.
Public exploitation evidence
- reported exploitationcore-jmp.org/2026/09/proxmox-ve-auth-bypass-cve-2023-54391/
- reported exploitationprevidian.com/CVE-2023-54391
- reported exploitationforum.proxmox.com/threads/proxmox-ve-7-is-vulnerable-to-some
- reported exploitationforum.proxmox.com/threads/proxmox-virtual-environment-securi
4 public reports collected from VulnCheck and CIRCL, first on Sep 1, 2026. Each links to its original source. We have not verified them.
Description
Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.