VulnCheck has disclosed ten vulnerabilities in Control Web Panel, the hosting control panel formerly known as CentOS Web Panel, that chain together into unauthenticated remote code execution as root. A working go-exploit module for CVE-2026-73695 is already public, and version 1.29 closes all ten flaws.
VulnCheck’s Valentin Lobstein Reports a CVSS 10.0 Chain in Control Web Panel
Researcher Valentin Lobstein of VulnCheck disclosed the flaws, which span CVE-2026-73695 through CVE-2026-104080. Individually, the entry flaw scores CVSS 9.8 and the local root bugs score 8.8. Chained, they reach the maximum 10.0. The affected product is Control Web Panel before version 1.29.
The Missing exit() Call Behind CVE-2026-73696 and CVE-2026-73695
The chain begins at the hosting-user panel on port 2083. When an unauthenticated visitor requests a protected page, the script sends a 302 redirect to the login page but lacks an exit() call, so it keeps running. It goes on to load PHP modules without any session, the behavior tracked as CVE-2026-73696 and CVE-2026-73695.
An attacker needs one valid hosting account name to proceed. The panel leaks that information through its responses, returning a 302 for an existing account and a 404 otherwise. That difference lets an attacker test candidate names against the panel until one responds with a redirect, which supplies the single prerequisite for the chain.
Command Execution as the Hosting User via CVE-2026-73697 and CVE-2026-77876
Two modules turn the session bypass into code execution. The phpini_editor module, CVE-2026-73697, allows webshell writes and command injection. The protected_directory module, CVE-2026-77876, provides a second route. Both yield command execution as the hosting user.
A Root-Run Local API on Port 2302 Completes the Takeover
The final step uses a local API that runs as root and listens on 127.0.0.1:2302. It lacks token checks, tracked as CVE-2026-77877. It also contains root command injection and SQL injection flaws: CVE-2026-77878, CVE-2026-104080, CVE-2026-77879, CVE-2026-77880 and CVE-2026-77881. A hosting-user shell can call the API directly and escalate to root. Because the API listens only on the loopback interface, an attacker must first run commands on the server, which is why the earlier command-execution steps are essential to the chain.
Which builds are exposed depends on the version. Builds before 1.12 expose the full pre-authentication root chain over the network. Builds from 1.12 to 1.27 remain open to local root takeover by any hosting user. VulnCheck tested the chain on CWP7 build 1.8 running on AlmaLinux 9.
Internet Exposure Counts Run From 19,834 to 210,000 Hosts
Scan data puts a large number of panels in view. ZoomEye tracks about 210,000 hosts on port 2083, Shodan about 23,000, and VulnCheck counted 19,834 exposed user panels. The spread reflects different scanning methods and counting rules, and the figures do not show how many of those hosts run vulnerable builds.
No in-the-wild attacks have been confirmed. The disclosure notes that earlier Control Web Panel bugs were mass-exploited soon after disclosure, and the public go-exploit module for CVE-2026-73695 removes the main barrier to doing so again.
Control Web Panel Shared-Hosting Servers Face Full Root Compromise
Control Web Panel is used to manage shared-hosting servers, where one machine carries many customers’ sites. Root access there reaches every hosted account, database and mail store on the server. The local root path also matters in shared environments: any customer with a hosting account on a build between 1.12 and 1.27 holds a route to the whole machine without the network-facing bypass.
Fixes arrived as staged updates on the disclosure day. Version 1.29 closes all ten issues, and version 1.30 is also referenced as a fixed release. Administrators are directed to update to 1.29 or 1.30.
The combination of a published exploit, a large searchable population on a single well-known port and a history of fast mass exploitation leaves a short interval between disclosure and probable attack activity.
