CVE-2026-12196highCWE-287

CVE-2026-12196: high-severity vulnerability in hestiacp

HestiaCP Admin Takeover

Published · Updated

Follow this CVE+ Monitor hestiacp

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 8.3epss 0.4%
HestiaCP panel cronjob feature is affected by a broken access control vulnerability. Low privilege users can modify the panel cronjob to execute scripts HestiaCP management scripts with passwordless sudo. This could result in the takeover of administrator users in the application and the underlying webserver.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Affected products
hestiacp · hestiacp
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — hestiacp

In the same product, most dangerous first.

CVE-2025-30007HIGHHestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record ManagementEPSS 3.2%CVE-2026-43633CRITICALHestiaCP 1.9.0-1.9.4 Deserialization RCE via Web TerminalEPSS 1.1%CVE-2026-108390CRITICALHestiaCP Low-Privileged User to Root via Config-Field Injection and PATH HijackingEPSS 0.7%CVE-2026-111627HIGHHestiaCP before 1.10.5 Protected Admin Bypass via Cron Job CreationEPSS 0.6%CVE-2025-30008MEDIUMHestiaCP < 1.9.5 Stored XSS via DNS Record Management InterfaceEPSS 0.3%CVE-2026-43634HIGHHestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP HeaderEPSS 0.2%