Broken Access Control Vulnerability in HestiaCP Panel
CVE-2026-12196

8.3HIGH

Key Information:

Vendor

Hestiacp

Status
Hestiacp
Vendor
CVE Published:
4 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-12196?

The HestiaCP panel features a broken access control vulnerability within its cronjob functionality. This issue allows low privilege users to modify cronjobs, enabling them to execute HestiaCP management scripts without proper authentication. As a result, attackers can potentially gain unauthorized access to administrative privileges and compromise the security of the application as well as the underlying webserver.

Affected Version(s)

hestiacp 0 < 8be23943c7e3231f66d226ca931c76f93be98412

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-12196 - Proof of Concept

References

https://github.com/hestiacp/hestiacp/pull/5440
patch
https://projectblack.io/blog/hestiacp-admin-takeover-rce/
exploit

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.