Vulnerability · Published May 19, 2026 · Assigned by VulnCheck

CVE-2026-43633HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal

Critical 10.0

In plain English

A critical-severity unsafe deserialization in hestiacp from hestiacp. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)1.1%top 34.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js that allows unauthenticated remote attackers to achieve root-level code execution. Attackers can inject crafted data into HTTP headers that are processed by the PHP session handler but incorrectly deserialized by the Node.js web terminal component as trusted session values, resulting in arbitrary command execution on systems with the web terminal feature enabled.

Affected products (as reported)

Vendor	Product	Versions
hestiacp	hestiacp	1.9.0 – through 1.9.4

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://mercuryiss.com.au/hestiacp-unauthenticated-rce-ip-spoofing-cve-2026-43633-cve-2026-43634 technical-description, exploit
https://github.com/hestiacp/hestiacp/issues/5229 issue-tracking
https://github.com/hestiacp/hestiacp/pull/5244 issue-tracking
https://github.com/hestiacp/hestiacp/commit/854d71b3c1737b0a0d0cc55c926008ffe1f6719b patch
https://www.vulncheck.com/advisories/hestiacp-deserialization-rce-via-web-terminal third-party-advisory