Threat Actors Scanning for Vulnerabilities in Legacy Proxmox VE 7 Servers

Background and Observed Activity

Recent intelligence indicates an increase in malicious scanning targeting older instances of Proxmox Virtual Environment (VE). The activity follows a vendor disclosure highlighting a security vulnerability isolated to Proxmox VE version 7—a legacy release line that has reached end-of-life status. Threat actors frequently exploit the window between vulnerability disclosures and administrative patch deployment to compromise internet-exposed systems.

Because Proxmox VE 7 has lacked official vendor support for several years, organizations running these unmaintained instances remain exposed to potential remote exploitation. Virtualization hypervisors represent high-value targets, as unauthorized access may allow adversaries to move laterally into guest operating systems, exfiltrate sensitive images, or disrupt core enterprise workloads.

FORTSECURE Recommended Mitigation Actions

• Upgrade Immediately to Supported Versions: Organizations running Proxmox VE 7 must migrate to currently supported release branches (such as version 8.x) to receive regular security updates and patches.
• Restrict Administrative Interfaces: Never expose hypervisor management consoles or SSH access directly to the public internet. Use dedicated management VLANs, zero-trust network access (ZTNA), or enterprise VPNs with multi-factor authentication (MFA).
• Perform Perimeter Audits: Regularly inventory public-facing IP ranges to detect unmanaged virtualization assets or forgotten legacy infrastructure.

---

แหล่งที่มา: SANS Internet Storm Center เผยแพร่ครั้งแรก: Wed, 09 Sep 2026 17:46:24 GMT บทความต้นฉบับ: อ่านต้นฉบับ