CVE-2026-71965

Received Received - Intake

Authenticated Remote Code Execution in CyberPanel via Malicious Backup Server

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: VulnCheck

Description

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code execution vulnerability in the remote backup feature that allows authenticated attackers to gain root-level SSH access by supplying a malicious remote server address. Attackers can exploit the unverified SSH public key retrieval process to write an attacker-controlled public key directly to /root/.ssh/authorized_keys, granting persistent root access to the host system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-71965

EUVD

EUVD-2026-55735

Affected Vendors & Products

Vendor	Product	Version / Range
cyberpanel	cyberpanel	2.4.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

CVE-2026-71965 is an authenticated remote code execution vulnerability in CyberPanel version 2.4.3. It exists in the remote backup feature and allows attackers with valid credentials to gain root-level SSH access. The flaw stems from an unverified SSH public key retrieval process, enabling attackers to write a malicious public key to /root/.ssh/authorized_keys, which grants persistent root access to the system.

Detection Guidance

Check for unauthorized modifications to /root/.ssh/authorized_keys or unexpected SSH public keys. Inspect CyberPanel logs for suspicious remote backup configurations or connections to untrusted servers.

Impact Analysis

This vulnerability allows attackers to gain full root access to the affected system if they have valid authentication credentials. Once exploited, attackers can execute arbitrary commands, steal sensitive data, install malware, or use the system for further attacks. The impact includes complete system compromise and potential lateral movement within a network.

Compliance Impact

This vulnerability can lead to severe compliance violations under GDPR and HIPAA due to unauthorized root access and potential data breaches. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Exploitation could result in unauthorized data access, leading to legal penalties, fines, and reputational damage for organizations.

Mitigation Strategies

Upgrade CyberPanel to a version that includes commit eca0c3c or later. Remove any unauthorized public keys from /root/.ssh/authorized_keys and disable remote backup features until patched.

Hi! I’m here to help you understand CVE-2026-71965. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70