CVE-2026-71966 – CyberPanel
“Authentication and command-handling flaws can turn CyberPanel access into full control of the underlying server.”
CyberPanel is affected by five vulnerabilities spanning forged authentication, root-level access, command injection, arbitrary file reads, and path traversal. CVE-2026-67614 has a CVSS score of 9.8, Critical severity and can allow an unauthenticated remote attacker to forge authentication tokens and obtain an interactive root shell. CVE-2026-71965 and CVE-2026-71966 each have a CVSS score of 8.8, High severity; their impact includes persistent root SSH access and arbitrary OS command execution.
CVE-2026-71964 has a CVSS score of 6.5, Medium severity and can expose arbitrary system files through crafted ZIP archives. CVE-2026-67613 has a CVSS score of 4.9, Medium severity and can expose files readable by the CyberPanel process through path traversal. Public proof-of-concept information is available for CVE-2026-71966 and CVE-2026-71964.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- Low
- User Interaction
- None
- CWE Classification
- CWE-78