CWP takeover flaw CVE-2026-57517: exploit code is public

A vulnerability that can let an attacker take over a server without any login has been found in "Control Web Panel (CWP, formerly CentOS Web Panel)," a free management dashboard widely used to run rented servers and VPSes. It is tracked as CVE-2026-57517, with a severity of 9.8 out of 10 under CVSS 3.1 ("Critical") and 9.3 under the newer CVSS 4.0.

An attacker can freely manipulate the database CWP uses while holding no password and no login session, simply by sending a crafted request. From there it can lead to planting a malicious program (a web shell) on the server and taking it over. The attack is not entirely blind, though: it requires knowing or correctly guessing the username of a valid non-root CWP account on the target server. Exploit code is already public, while no exploitation in the wild has been reported as of July 29, 2026. Any server running CWP should move to the current release shown in the changelog now.

Who would exploit this, and why

The target audience for attackers is the anonymous mass of attackers who can reach an internet-exposed CWP dashboard. A CWP dashboard is often opened over the network as the entry point for operating a server, and the danger of this flaw is that it can be tried with no password and no special privileges. Attackers mechanically hunt for exposed servers and fire attacks at every one they find.

There is one precondition on the attacker's side. According to the finder's advisory (KIS-2026-12), the entry point is a URL of the form https://[CWP_Host]:2083/[CWP_Username]/, and the attack only works if the attacker knows or correctly guesses the username of a valid non-root account on that CWP instance. No password and no session are needed, which is what makes it unauthenticated, but it is not a shot fired into the dark. Usernames are often inferable from a domain name or a published email address, and dictionary guessing works too, so this is not a condition to lean on as a defense.

What an attacker can do is freely manipulate CWP's database with a crafted request and use that as a foothold to plant a malicious program (a web shell) on the server and take it over. A web shell is a backdoor program that lets an attacker send commands to the server through a browser.

If a server management panel is taken over, the damage is not limited to one machine. CWP is used to manage many websites, mail, and databases together on a single server, so a takeover leads at once to tampering with every site running on it, leaks of customer data, and turning the box into a springboard for phishing sites and spam. If a hosting provider uses it, the many customers sharing that server can be caught in the blast. That is why the update below should be your top priority.

What Control Web Panel (CWP) is

Control Web Panel is a free management tool (a control panel) that lets you administer a Linux server entirely through screen operations. It was previously known as "CentOS Web Panel." Because it lets you publish websites, create mail accounts, manage databases, and set up SSL certificates in the browser without typing commands, it is widely used from individuals to small hosting providers as an alternative to paid panels like cPanel.

So how many CWP dashboards are exposed on the internet? No public data giving an accurate count could be found. Shodan, Censys, and Shadowserver all publish nothing specific to CWP, and the wording used by trade press goes no further than "tens of thousands." No reliable breakdown by country could be confirmed either. Whatever the total, whether your own server is affected is a question you settle by checking its version — check that rather than a headline number.

The problem is that CWP is a long-standing "favorite target" for attackers. Its dashboard is easy to expose to the internet, and the payoff for a takeover is large, so unauthenticated takeover flaws have been exploited repeatedly in the past. This CVE-2026-57517 is a new entry in that lineage.

What actually happens: inside the flaw

The cause is insufficient checking when CWP incorporates received input into a command sent to the database. According to the NVD (the U.S. NIST vulnerability database) description, by placing a crafted string in a submitted field (the userRes POST parameter), an attacker can execute arbitrary database commands (SQL). This is SQL injection (CWE-89), a classic but high-impact flaw.

The type here is called "blind SQL injection": even without the results being shown directly on screen, the contents of the database can be inferred and extracted one character at a time from differences in the system's responses. Sensitive information stored in the database — such as administrator account credentials and settings — can be read out. Because all of this can be done by someone holding no password and no session, the severity is rated 9.8 under CVSS 3.1 (Critical) and 9.3 under CVSS 4.0.

What makes it worse is the privilege the injected SQL runs with. Per the finder's advisory, the queries execute as the MySQL root user, which holds the global FILE privilege. That lets an attacker write files anywhere writable on the server using SQL's own file output. Dropping a malicious PHP file into a web-accessible directory turns the flaw into full remote code execution (RCE). That is the route the NVD refers to when it says the flaw can lead to arbitrary program execution. The SQL injection itself works reliably; the file write depends on the environment and configuration — but for software running close to administrator privileges, like CWP, it is a realistic threat.

Exploit code is public; exploitation in the wild is not confirmed

Treating this flaw as "nobody is using it yet, so it can wait" is a mistake. Working exploit code is already public. The finder published a proof of concept alongside the advisory, and several third-party versions appeared in early July 2026. One of them pairs mass scanning for vulnerable servers with an interactive shell for operating whatever it finds. CISA's supplementary assessment on the NVD entry, dated July 1, 2026, rates the exploitation status as "Proof-of-Concept" and marks the attack as automatable. In other words, this is within reach of attackers with modest skill.

At the same time, no report of exploitation in the wild has been confirmed as of July 29, 2026. This CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, no organization publishing observation data has reported it, and the major trade press has not covered it. If you come across an article saying CWP is being actively attacked, check the date and the CVE number — in nearly every case it refers to a different flaw, either CVE-2025-48703 (November 2025) or CVE-2022-44877 (January 2023).

The position today, then, is that the weapon is circulating but no use of it has been recorded. Past CWP flaws have repeatedly seen automated attacks begin within days of disclosure, which is why the absence of exploitation reports is not a reason to wait.

Is my server at risk? A version-by-version guide

Log in to the CWP dashboard and check the version shown. One practical warning first: CWP has switched its numbering from the four-part "0.9.8.1225" style to a "1.2" style. Compare the digits alone and 1.2 looks older than 0.9.8.1235, but the opposite is true — the 0.9.8.x line comes before the 1.x line. Read the table below with that in mind.

If you restrict access to the dashboard to trusted IP addresses only, attacks from the anonymous masses are harder to reach you, so the urgency drops. Even so, the possibility of misconfiguration or an internal attack remains, so updating is the safe choice either way.

Background: CWP is a habitual target for unauthenticated takeover

This CVE-2026-57517 should not be dismissed as a one-off flaw. CWP is a product where vulnerabilities allowing unauthenticated server takeover have been found again and again and actually used in large-scale attacks. It has been listed multiple times in the U.S. agency CISA's "Known Exploited Vulnerabilities (KEV)" catalog. Lined up chronologically, the pattern of repeat abuse is clear.

Why is CWP targeted repeatedly? The backdrop is a structural one: the server management panel — the most powerful entry point of all — tends to be exposed directly to the internet. In exchange for its convenience, the panel is a high-return target for attackers, because a takeover instantly hands over the whole server. Note that the two earlier entries above are separate flaws from this one: most reporting about "CWP being attacked" refers to those two, not to confirmed exploitation of CVE-2026-57517. That said, past CWP flaws have often seen automated attacks begin soon after disclosure, and with exploit code circulating this time, "no exploitation reported yet" is no reason to relax. Vulnerabilities actually used in attacks can be tracked in our CISA KEV Dashboard (Japanese edition), and CWP-related entries may well appear there again.

What to do now

The top priority is to move CWP to the current release listed in the official changelog. CVE-2026-57517 itself is closed in 0.9.8.1225, but stopping there is not advisable: later releases stack up hardening for login and sessions, file system functions, and the API, and 0.9.8.1235 carries a line reading "New Security fix resolving recent vulnerability issues." Updating is done with a command on the server (yum update or CWP's built-in update feature). Confirm the target version in the official changelog.

Two things to watch when reading that changelog. [Update, August 4, 2026] First, the number in the banner at the top does not match the newest entry in the list below it. That is not an error — the two are different kinds of number. The banner's "Current Version" tracks the latest build actually being shipped and updates automatically; the list below is written up after the fact and only for major releases. The gap is long-standing: back on July 9 the banner read 0.9.8.1244 while the newest listed entry was 0.9.8.1235, nine builds behind. As of August 4, 2026 the banner reads "CWP7: 1.7," while the list documents nothing past "Version 1.2" (July 27) — releases 1.3 through 1.7 have no published notes at all. The banner moves every few days, so by the time you read this it may be 1.8 or higher. The test is not "is my version in the list" but "has my version caught up with the banner." Second, the dates are written day/month/year — "27/07/2026" is July 27. Read them as month/day and you will get the order of releases backwards. Also, the changelog pages at wiki.centos-webpanel.com and centos-webpanel.com that rank high in search results are either gone or frozen since 2018. The one to use is control-webpanel.com/changelog.

Beyond updating, it is safe to review the defenses specific to a management panel. First, do not expose the dashboard (by default on ports such as 2030/2031) to the whole internet; restrict source addresses to the IPs you actually use. Limiting it to your office or home fixed line, or to VPN access only, blocks almost all automated attacks from the anonymous masses. Next, place a WAF (a mechanism that detects and stops malicious traffic) in front, and check whether you have already been breached. Look for unfamiliar PHP files, administrator accounts, unexpected database changes, or suspicious traffic, and if anything looks wrong, rotate all passwords and database credentials.

Summary

CVE-2026-57517 is a vulnerability in the CWP server management panel where someone holding no password and no session can manipulate the database and ultimately take over the server. The severity is top-class: 9.8 under CVSS 3.1, 9.3 under CVSS 4.0. Exploitation requires knowing or guessing a non-root CWP username, which is rarely hard. Exploit code is public; exploitation in the wild has not been reported so far.

CWP is a standard target for attackers, with unauthenticated takeover flaws repeatedly exploited in the past. Assume automated attacks could begin at any time: update immediately, and switch to an operation that does not expose the dashboard to the internet. The target is not 0.9.8.1225 — it is the current release listed in the official changelog. Start by checking, right now, which version your server's CWP is on.

References

• ▸NVD - CVE-2026-57517 Detail (U.S. NIST)
• ▸Karma(In)Security - KIS-2026-12 (the finder's advisory)
• ▸Control Web Panel official - Changelog (where to confirm the current release)
• ▸VulnCheck - Control Web Panel Blind SQL Injection via userRes Parameter
• ▸NVD - CVE-2025-48703 (a separate flaw: earlier unauthenticated RCE, in KEV)
• ▸NVD - CVE-2022-44877 (a separate flaw: earlier unauthenticated RCE, mass-exploited)
• ▸BleepingComputer - CISA warns of critical CentOS Web Panel bug exploited (coverage of CVE-2025-48703)
• ▸CISA - Known Exploited Vulnerabilities Catalog (KEV)