---
id: 3709
title: "[CVE-2026-12196] HestiaCP Admin Takeover & RCE"
cve: CVE-2026-12196
source_domain: projectblack.io
source_url: "https://projectblack.io/blog/hestiacp-admin-takeover-rce/"
published_at: "2026-07-04 12:00"
tags: ["rce", "vulnerability-research", "access-control", "hestiacp", "privilege-escalation", "vulnerability", "broken-authorization", "cve-2026-12196"]
phying_url: "https://phying.com/item/3709"
lang: en
---

# [CVE-2026-12196] HestiaCP Admin Takeover & RCE

## Summary

Project Black details CVE-2026-12196 in HestiaCP: a broken authorization check lets any low-privileged user exploit panel cron jobs to run sudo scripts and reset the admin password.

## Intelligence Metadata

- **Sources:** projectblack.io
- **CVE:** CVE-2026-12196
- **Published:** 2026-07-04 12:00
- **Original:** https://projectblack.io/blog/hestiacp-admin-takeover-rce/
- **Phying News:** https://phying.com/item/3709