Scans for Proxmox Servers, (Wed, Sep 9th)
SANS observed increased scanning and brute-force attacks on port 8006 targeting unsupported Proxmox VE 7 servers after a recent vulnerability advisory.
SANS Internet Storm Center reported a bump in scans for port 8006 and additional brute-force traffic against Proxmox VE servers following a Proxmox advisory about a vulnerability in older releases. The flaw only affects Proxmox VE version 7, which has been unsupported for a couple of years. Observed activity includes POST requests to /api2/json/access/ticket with root@pam usernames and weak passwords, fingerprinting requests, and POSTs to /api2/extjs/access/ticket; failed logins return 401 status codes and non-TLS POSTs return 308 redirects.
- Scans target port 8006, the Proxmox VE API, including fingerprinting requests to /pve2/images/logo-128.png.
- Brute-force attempts POST to /api2/json/access/ticket with root@pam usernames and simple passwords.
- Non-TLS POSTs return 308 redirects; failed authentication shows 401 status codes in PVE proxy logs.
- The vulnerability affects only unsupported Proxmox VE 7; no confirmed exploitation of the flaw is reported.
- Vendors
- Proxmox
- Products
- Proxmox VE
- Organizations
- SANS Internet Storm Center
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 62.60.130.193 | ll log failed login attempts with a 401 status code: ::ffff:62.60.130.193 - - [09/09/2026:15:26:14 +0000] "POST /api2/json/access/tic |
From the original article
1 min read at isc.sans.eduAbout a week ago, Proxmox published an advisory revealing a vulnerability in older versions of Proxmox VE, its flagship Virtual Environment product. The vulnerability only affects version 7, which has not been supported for a couple of years now.
isc.sans.edu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.