CVE-2026-12196

8.3 highEPSS 0.4%

High (8.3). EPSS 0.4% chance of exploitation in the next 30 days.

HestiaCP panel cronjob feature is affected by a broken access control vulnerability. Low privilege users can modify the panel cronjob to execute scripts HestiaCP management scripts with passwordless sudo. This could result in the takeover of administrator users in the application and the underlying webserver.

Severity

CVSS 4.0

8.3 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2026-07-04
Modified: 2026-07-06
Record from: the NVD, synced 2026-10-19

References

https://github.com/hestiacp/hestiacp/pull/5440
https://projectblack.io/blog/hestiacp-admin-takeover-rce/

Check your stack JSON