Proxmox security advisories, September 2026

Every Proxmox security advisory published in September 2026, from Proxmox Security Advisories + NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 2
Critical: 1
High: 0
In CISA KEV: 0
CVEs: 2

Proxmox advisories published in September 2026

Sep 21, 2026
Medium [CVE-2026-94588] In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality
Medium4.4
Sep 1, 2026
Critical [CVE-2023-54391] Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint
Critical9.3

Get an email when Proxmox publishes the next one.

See Proxmox's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Proxmox

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.