An internal database user with superuser privileges in Percona PMM can exploit the 'Add data source' function to escape the database context and launch arbitrary shell commands on the host operating system. This flaw permits complete compromise of the underlying system, allowing an attacker to read, modify or delete any data, exfiltrate sensitive information, or pivot to other systems. The weakness is a privilege escalation vulnerability, classified as CWE-250.

Percona Monitoring and Management versions earlier than 3.7 are affected. The vulnerability is present in any deployment where an attacker can obtain pmm‑admin privileges or equivalent and use the Add data source feature. All supported operating systems running these versions are potentially impacted.

The CVSS score of 9.9 indicates a critical severity, and the lack of EPSS data suggests the exploit could be readily available to those with the necessary administrative access. Since this flaw allows execution of arbitrary shell commands, the impact is system‑wide and the exploitability is high for users with pmm‑admin rights. This vulnerability is not listed in the CISA KEV catalog, but the critical score warrants urgent attention.