Skip to content
[CVE-2026-12196] HestiaCP Admin Takeover & RCE
projectblack.io | research | CVE-2026-12196 | #rce | #vulnerability-research | #access-control | #hestiacp | #privilege-escalation | #vulnerability | #broken-authorization | #cve-2026-12196
Summary
Project Black details CVE-2026-12196 in HestiaCP: a broken authorization check lets any low-privileged user exploit panel cron jobs to run sudo scripts and reset the admin password.
- Published
- Collected