Vulnerability · Published Aug 10, 2026 · Assigned by VulnCheck

CVE-2026-71965CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature

High 8.8

In plain English

A high-severity insufficient verification of data authenticity in cyberpanel from usmannasir. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 58.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code execution vulnerability in the remote backup feature that allows authenticated attackers to gain root-level SSH access by supplying a malicious remote server address. Attackers can exploit the unverified SSH public key retrieval process to write an attacker-controlled public key directly to /root/.ssh/authorized_keys, granting persistent root access to the host system.

Affected products (as reported)

Vendor	Product	Versions
usmannasir	cyberpanel	0 – through 2.4.3

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Researcher Blog technical-description, exploit
Patch Commit patch
https://www.vulncheck.com/advisories/cyberpanel-authenticated-rce-via-remote-backup-feature third-party-advisory