High severity · published Jul 4, 2026
CVE-2026-12196
HestiaCP Admin Takeover
8.3
CVSS
0.4%
EPSS
No
On KEV
Description
HestiaCP panel cronjob feature is affected by a broken access control vulnerability. Low privilege users can modify the panel cronjob to execute scripts HestiaCP management scripts with passwordless sudo. This could result in the takeover of administrator users in the application and the underlying webserver.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HE
hestiacp · hestiacp
before 8be23943c7e3231f66d226ca931c76f93be98412 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-12196
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-12196
github.com
https://github.com/hestiacp/hestiacp/pull/5440
projectblack.io
https://projectblack.io/blog/hestiacp-admin-takeover-rce/
More from hestiacp
10.0
CVE-2026-43633
HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal
9.9
CVE-2026-108390
HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking
8.8
CVE-2025-30007
HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management
7.8
CVE-2023-5839
Privilege Chaining in hestiacp/hestiacp
7.5
CVE-2026-43634
HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header