Scans for Proxmox Servers, (Wed, Sep 9th)
SANS observed increased scanning and brute-force attacks on port 8006 targeting unsupported Proxmox VE 7 servers after a recent vulnerability advisory.
SANS Internet Storm Center reported a bump in scans for port 8006 and additional brute-force traffic against Proxmox VE servers following a Proxmox advisory about a vulnerability in older releases. The flaw only affects Proxmox VE version 7, which has been unsupported for a couple of years. Observed activity includes POST requests to /api2/json/access/ticket with root@pam usernames and weak passwords, fingerprinting requests, and POSTs to /api2/extjs/access/ticket; failed logins return 401 status codes and non-TLS POSTs return 308 redirects.
- Scans target port 8006, the Proxmox VE API, including fingerprinting requests to /pve2/images/logo-128.png.
- Brute-force attempts POST to /api2/json/access/ticket with root@pam usernames and simple passwords.
- Non-TLS POSTs return 308 redirects; failed authentication shows 401 status codes in PVE proxy logs.
- The vulnerability affects only unsupported Proxmox VE 7; no confirmed exploitation of the flaw is reported.
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 62.60.130.193 | ll log failed login attempts with a 401 status code: ::ffff:62.60.130.193 - - [09/09/2026:15:26:14 +0000] "POST /api2/json/access/tic |
Full article324 words · extracted from isc.sans.edu · click to collapse
About a week ago, Proxmox published an advisory revealing a vulnerability in older versions of Proxmox VE, its flagship Virtual Environment product. The vulnerability only affects version 7, which has not been supported for a couple of years now.
But it appears that the vulnerability may have caught the attention of some attackers and researchers. We do see a bump in scans for port 8006, and also some additional brute force traffic. For example, brute force requests like:
POST /api2/json/access/ticket HTTP/1.1
Host: [redacted]:8006
User-Agent: Go-http-client/1.1
Content-Length: 37
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
password=Ww778899&username=root%40pam
The PVE proxy log will log failed login attempts with a 401 status code:
::ffff:62.60.130.193 - - [09/09/2026:15:26:14 +0000] "POST /api2/json/access/ticket HTTP/1.1" 401 50
::ffff:62.60.130.193 - - [09/09/2026:15:28:04 +0000] "POST /api2/json/access/ticket HTTP/1.1" 308 18
::ffff:62.60.130.193 - - [09/09/2026:15:28:08 +0000] "POST /api2/json/access/ticket HTTP/1.1" 401 50
::ffff:62.60.130.193 - - [09/09/2026:15:29:49 +0000] "POST /api2/json/access/ticket HTTP/1.1" 308 18
::ffff:62.60.130.193 - - [09/09/2026:15:29:52 +0000] "POST /api2/json/access/ticket HTTP/1.1" 401 50
::ffff:62.60.130.193 - - [09/09/2026:15:31:33 +0000] "POST /api2/json/access/ticket HTTP/1.1" 308 18
::ffff:62.60.130.193 - - [09/09/2026:15:31:36 +0000] "POST /api2/json/access/ticket HTTP/1.1" 401 50
You may also see the less commonly used 308 status code if the attacker does not use TLS on their first attempt and instead sends a POST request (as shown above). A 308 access code allows a client to change the request method after following the redirect. 301 and 302 status codes require the same method for the follow-up request.
Other scans I have seen:
Classic Fingerprinting
/pve2/images/logo-128.png???????
And a POST request to /api2/extjs/access/ticket . This endpoint behaves differently from the prior endpoint. It always returns 200, but the JSON payload will contain the login failed messages. These are trickier to analyze because the proxy log does not indicate the outcome of authentication. A return payload size of 77 bytes should indicate failure.
--
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter |
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Text extracted automatically; images, tables and formatting may be missing. Original: https://isc.sans.edu/diary/rss/33324