THE ISC note reports that Proxmox has published an advisory about a vulnerability in older Proxmox VE versions, specifically affecting the Proxmox VE 7 line, which has not been supported for several years. According to the diary, the issue has drawn attention from attackers and researchers, with a noticeable uptick in scans targeting port 8006 and in brute‑force login attempts.
Notably, attempts observed involve POST requests to the Proxmox API endpoints, such as /api2/json/access/ticket, attempted with credentials like password=Ww778899&username=root%40pam, and responses in the proxy log showing repeated 401 status codes and occasional 308 redirects.
The diary describes how the Proxmox Proxy logs reveal failed login attempts, including entries like ::ffff:62.60.130[.]193 - - [09/09/2026:15:26:14 +0000] "POST /api2/json/access/ticket HTTP/1.1" 401 50, with later entries showing 308 responses and multiple similar attempts.
It also notes other activity patterns, such as classic fingerprinting requests to /pve2/images/logo-128[.]png and a POST to /api2/extjs/access/ticket, the latter of which consistently returns 200 but with a JSON payload containing login failed messages; a payload size of 77 bytes is suggested as an indicator of failure. The article emphasises that these signals are from scans rather than confirmed successful exploitation.
Practical response calls for monitoring 8006 for brute‑force patterns, reviewing PVE proxy logs for failed login signals, and recognising the different responses from the two endpoints noted. It also highlights that older, unsupported versions are the likely target and that attackers may be seeking unauthorised access via the API.