CVE-2026-49243 – Webmin
CVSS 9.6
CRITICAL
[2] Critical – Same Day Deployment
“One click on the wrong link hands an attacker the keys to the server room”
Webmin, the web-based system administration tool for Unix-like servers, has a critical cross-site scripting flaw. CVE-2026-49243 has a CVSS score of 9.6, Critical severity. A Webmin user who clicks a malicious link pointing to their own server triggers the flaw, and the attacker can then run commands of their choosing on that server. Webmin manages core server functions, so one successful attack can hand an attacker administrative control of the system.
Webmin version 2.650 fixes this vulnerability. All earlier versions are affected. Upgrade every Webmin instance to version 2.650 or later.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- CWE Classification
- CWE-79
Patch this CVE on all your endpoints in under 5 minutes.
First 200 endpoints are free forever, scale as needed.