CVE-2023-54391Disclosure

MEDIUMCVSS 9.3 · CRITICAL

Exploitation observed; activity peaked at 4 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.

Back to dashboard

5.8/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-304

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 4 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
17 mentions across 8 observed days

What's happening

Active exploitation reported across 4 signals
PoC mentioned or linked in 3 signals
Patch or workaround mentioned in 3 signals
Technical details provided in 10 signals
Disclosure: 8 classified signals
Peaked 7d ago at 4 mentions (2026-09-02); latest day: 1
17 total mentions across 8 days

Deep dive

Activity timeline17 mentions / 8d

Signal classification5 categories

Disclosure

847.1%

Active Exploitation

423.5%

Patch

211.8%

General

211.8%

PoC

15.9%

Referenced assets14 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-02	4	Disclosure3Patch1
2026-09-03	4	Active Exploitation1Disclosure3
2026-09-04	1	Disclosure1
2026-09-05	1	PoC1
2026-09-07	2	Active Exploitation1Patch1
2026-09-08	3	Active Exploitation2Disclosure1
2026-09-09	1	General1
2026-09-16	1	General1

Full discourse17 posts

pdnuclei-bot@pdnuclei_bot43d
Disclosure
🚨 CVE-2023-54391 - critical 🚨 Proxmox VE - Default Credentials with TFA Bypass > Detected Proxmox VE was accessible using default root@pam credentials combined with a... 👾 https://cloud.projectdiscovery.io/library/CVE-2023-54391 @pdnuclei #NucleiTemplates #cve
Post summary
The post announces a critical CVE in Proxmox VE that allows TFA bypass via default root credentials, includes a link to detection resources, but does not provide an exploit, patch, or evidence of active attacks.
07028141.7K
1.3K followersView on X
IT-Connect.fr@ITConnect_fr40d
Active Exploitation
⚠️ Cette faille Proxmox corrigée en 2023 est activement exploitée (CVE-2023-54391) Surtout, elle est restée dans l'ombre pendant 3 ans. Retrouvez mon article à ce sujet 👇 - https://www.it-connect.fr/proxmox-ve-cve-2023-54391-contournement-authentification/ #Proxmox #infosec #cybersecurite https://t.co/KHtERirjyf
Post summary
The tweet indicates that CVE-2023-54391, a Proxmox vulnerability fixed in 2023, is currently being exploited in the wild.
160641.0K
11.7K followersView on X
YesWeHack ⠵@yeswehack39d
General
What happens when a vulnerability is fixed… but nobody is told it was a vulnerability? 👀 CVE-2023-54391 shows how silent patches can widen the attacker-defender info gap – especially as AI makes old fixes easier to excavate 🤖⛏️ A must-read 👇 https://www.yeswehack.com/lab/cve-2023-54391-silent-patches?utm_source=twitter&utm_medium=social&utm_campaign=cve-2023-54391-silent-patches
Post summary
The tweet hints at the issue of silent patches widening the attacker‑defender information gap but offers no concrete POC, exploit code, or technical details about CVE‑2023‑54391.
1201021.8K
43.3K followersView on X
ProxCenter@ProxCenter46d
Disclosure
🚨 CVE-2023-54391 : Critical authentication bypass affecting Proxmox VE 7.0–8.0 (CVSS 9.8). ProxCenter's built-in CVE Scanner helps identify vulnerable hosts across your infrastructure. https://www.cve.org/CVERecord?id=CVE-2023-54391 #Proxmox #ProxCenter
Post summary
Announcement of CVE-2023-54391, a critical authentication bypass vulnerability in Proxmox VE 7.0–8.0, with a CVSS score of 9.8.
10092537
951 followersView on X
にゃん☆たく/takumi.a@taku888infinity45d
Disclosure
CVE-2023-54391 Subject: PSA-2026-00043-1: Authentication bypass in EOL Proxmox VE 7 release https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/post-867929 https://www.cve.org/CVERecord?id=CVE-2023-54391 『Proxmox Virtual Environment (VE) 7.0～8.0には、libpve-access-control 8.0.4より前のバージョンに認証バイパスの脆弱性が存在します。この脆弱性により、認証されていない攻撃者は、APIログインエンドポイントで任意のtfa-challenge値を指定することで、設定済みの2要素認証なしで、既存の有効なユーザーとして認証できてしまいます。』
Post summary
Proxmox VE versions earlier than libpve-access-control 8.0.4 contain an authentication bypass that lets unauthenticated attackers log in as valid users by setting arbitrary tfa‑challenge values, as detailed in the Proxmox forum post and CVE record.
010521.0K
11.9K followersView on X
IT-ADMlNISTRATOR@ita_blog40d
Disclosure
🚨 Kritische Proxmox-Lücke: CVE-2023-54391 ermöglicht in älteren Proxmox-VE-Versionen unter bestimmten Voraussetzungen einen Login ohne gültiges Passwort. CVSS: 9,8.Admins sollten Paketversion und Erreichbarkeit von Port 8006 jetzt prüfen. 👉 Mehr auf https://www.it-administrator.de/kritische-proxmox-luecke-login-ohne-passwort #Proxmox #Cybersecurity #ITSecurity #CVE
Post summary
The post announces the critical Proxmox CVE‑2023‑54391, noting it allows password‑less login on older versions, cites a CVSS score of 9.8, and urges administrators to verify their package versions and port 8006.
03011123
2.8K followersView on X
Remco@remcoros44d
Active Exploitation
Proxmox 7-8 (out of support) is actively being exploited; update ASAP! more info: https://forum.proxmox.com/threads/proxmox-ve-7-is-vulnerable-to-some-type-of-0day-rce-non-auth.186078/ CVE: https://www.cve.org/CVERecord?id=CVE-2023-54391
Post summary
Proxmox 7‑8 is being actively exploited; users should update immediately, as noted in the forum thread and CVE‑2023‑54391.
11030278
353 followersView on X
CrowdSec@Crowd_Security40d
Active Exploitation
🚨 In this week’s newsletter, we cover CVE-2023-54391, a critical authentication bypass affecting Proxmox VE that is seeing exploitation attempts. We break down how attackers can bypass password verification with a single unauthenticated request and what defenders should do next. Read the full analysis and protect your systems 👉 https://www.crowdsec.net/vulntracking-report/cve-2023-54391-proxmox-ve-authentication-bypass
Post summary
The newsletter discloses CVE-2023-54391, a critical authentication bypass in Proxmox VE, and notes that it is being exploited in the wild, urging defenders to review the linked analysis for remediation guidance.
00130684
19.4K followersView on X
Sébastien Raoult (Sezyo)@sebastienRaoult31d
General
@LiveOverflow Reminds me this great article from @yeswehack : https://www.yeswehack.com/fr/lab/cve-2023-54391-silent-patches
Post summary
The text mentions CVE-2023-54391 and links to an article about silent patches but does not provide specific details on PoC, exploitation, technical aspects, or remediation, making it a general reference.
0001048
1.4K followersView on X
CERT-PY@CERTpy44d
Disclosure
⚠️ Vulnerabilidad en productos PROXMOX ❗ CVE-2023-54391 ➡️ Más info: https://www.cert.gov.py/vulnerabilidad-en-productos-proxmox/ https://t.co/0MQUBIBT5p
Post summary
The tweet announces the existence of CVE-2023-54391 affecting Proxmox products and points to external links for further details.
00001212
6.7K followersView on X
CVE@CVEnew44d
Disclosure
CVE-2023-54391 Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated att… https://www.cve.org/CVERecord?id=CVE-2023-54391
Post summary
The post announces an authentication bypass vulnerability (CVE‑2023‑54391) in Proxmox VE 7.0‑8.0, providing component and version details but no exploit, patch, or active exploitation information.
000101.5K
58.1K followersView on X
CCB Alert@CCBalert45d
Patch
Warning: Authentication bypass in #Proxmox VE. CVE-2023-54391 CVSS: 9.8. An attacker that can access the API can login as any user that doesn’t have 2FA set up, by default this includes root@pam. More info: https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-4#post-867929 #Patch #Patch #Patch
Post summary
An authentication bypass (CVE‑2023‑54391) in Proxmox VE lets attackers log in as any user without 2FA via the API; the post indicates a patch is available, as referenced by the forum link.
00001310
7.2K followersView on X
thibault@akril40d
Active Exploitation
[IT-Connect] - Cette faille Proxmox corrigée en 2023 est activement exploitée (CVE-2023-54391) - https://www.it-connect.fr/proxmox-ve-cve-2023-54391-contournement-authentification/ 👌😁
Post summary
The text announces that CVE‑2023‑54391, a Proxmox vulnerability fixed in 2023, is currently being exploited in the wild, with a reference to a potential workaround.
0000056
685 followersView on X
Halil Deniz@denizhalilT40d
Patch
🚨 Critical Proxmox VE Vulnerability! CVE-2023-54391 allows remote unauthenticated attackers to bypass password checks using a TFA logic flaw and gain full root access. Patch immediately! Read more: https://denizhalil.com/2026/09/07/proxmox-ve-tfa-bypass-cve-2023-54391/ #Proxmox #Cybersecurity #CVE202354391 https://t.co/UjM1oTLekX
Post summary
The tweet announces a critical Proxmox VE vulnerability (CVE-2023-54391) that allows root bypass and urges immediate patching, but provides no PoC, exploit code, or evidence of active exploitation.
0000047
33 followersView on X
Rıdvan Yağlı@ridvanyagli42d
PoC
Proxmox VE'de TFA bypass sağlayan CVE-2023-54391 için PoC/template yayınlandı. Proxmox VE - Default Credentials with TFA Bypass : https://cloud.projectdiscovery.io/library/CVE-2023-54391
Post summary
A PoC/template for CVE‑2023‑54391, which permits bypassing two‑factor authentication in Proxmox VE, has been published; there is no evidence of active exploitation or remediation.
00000319
2.2K followersView on X
Cybersecurity News DE@cybsecuritynews45d
Disclosure
#schwachstellen Proxmox VE: Kritische Authentifizierungsumgehung in CVE-2023-54391 betrifft EOL-Versionen #cve202354391 #libpveaccesscontrol #proxmoxve70 #proxmoxve80 #proxmoxvirtualenvironment https://cybersecurity-news.de/proxmox-ve-cve-2023-54391-authentifizierungsumgehung
Post summary
The post announces a critical authentication bypass vulnerability (CVE-2023-54391) affecting EOL Proxmox VE versions, but does not provide PoC or exploit details.
0000041
10 followersView on X
Severity Daily@severitydaily45d
Disclosure
Proxmox closed an unauthenticated login bypass in 2023 without knowing it was a security fix. The CVE landed three years later. End-of-life VE 7 only; no supported release is affected. https://severitydaily.com/proxmox-cve-2023-54391-eol-ve-7-auth-bypass-psa-2026-00043-1/
Post summary
Proxmox reported a closed unauthenticated login bypass discovered in 2023, affecting only the end‑of‑life VE 7; no patches, exploits, or active abuse are detailed.
0000053
23 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2023-54391

YesWeHack ⠵[verified]@yeswehackGeneral

The tweet hints at the issue of silent patches widening the attacker‑defender information gap but offers no concrete POC, exploit code, or technical details about CVE‑2023‑54391.

ProxCenter[verified]@ProxCenterDisclosure

Announcement of CVE-2023-54391, a critical authentication bypass vulnerability in Proxmox VE 7.0–8.0, with a CVSS score of 9.8.

にゃん☆たく/takumi.a[verified]@taku888infinityDisclosure

Proxmox VE versions earlier than libpve-access-control 8.0.4 contain an authentication bypass that lets unauthenticated attackers log in as valid users by setting arbitrary tfa‑challenge values, as detailed in the Proxmox forum post and CVE record.

IT-ADMlNISTRATOR[verified]@ita_blogDisclosure

The post announces the critical Proxmox CVE‑2023‑54391, noting it allows password‑less login on older versions, cites a CVSS score of 9.8, and urges administrators to verify their package versions and port 8006.

CrowdSec[verified]@Crowd_SecurityActive Exploitation

The newsletter discloses CVE-2023-54391, a critical authentication bypass in Proxmox VE, and notes that it is being exploited in the wild, urging defenders to review the linked analysis for remediation guidance.

Sébastien Raoult (Sezyo)[verified]@sebastienRaoultGeneral

The text mentions CVE-2023-54391 and links to an article about silent patches but does not provide specific details on PoC, exploitation, technical aspects, or remediation, making it a general reference.

thibault[verified]@akrilActive Exploitation

The text announces that CVE‑2023‑54391, a Proxmox vulnerability fixed in 2023, is currently being exploited in the wild, with a reference to a potential workaround.

Rıdvan Yağlı[verified]@ridvanyagliPoC

A PoC/template for CVE‑2023‑54391, which permits bypassing two‑factor authentication in Proxmox VE, has been published; there is no evidence of active exploitation or remediation.