What happened
Control Web Panel (CWP, formerly CentOS Web Panel) is a free control panel for managing web hosting on Linux servers. On November 2, 2026, VulnCheck published a critical vulnerability in its user panel, tracked as CVE-2026-77876. It was added to the US National Vulnerability Database (NVD) the same day.
The flaw sits in the module used to password-protect directories (protected_directory). In one of its actions, the module fails to properly handle data sent by the visitor and passes it straight to the operating system as part of a command. That lets an attacker run their own commands on the server. It was discovered by security researcher Valentin Lobstein (Chocapikk).
CWP versions before 1.16 are affected. In the changelog for version 1.30.1, released November 3, 2026, the vendor describes broad security hardening across the whole panel and recommends the update for every server. It does not name this specific flaw separately, though.
So far, exploitation has not been confirmed by the vendor, by the US agency CISA (the flaw is not in its KEV catalog) or by the European vulnerability database EUVD. Hosting panels are a popular target for attackers, however, so this could change quickly.
Why it is dangerous
This is an operating system command injection flaw (CWE-78). Picture a receptionist who reads the file name from your form over the radio to a warehouse worker without checking it. If you write “and then open the safe” in the field, the worker simply does it. The panel likewise hands text from a visitor to a system command, so an attacker can tack their own commands onto it.
According to VulnCheck’s rating, the attack works over the network, is easy to carry out, needs no login and requires no action from the victim. The commands run in the context of the user panel, meaning with its permissions. VulnCheck does not say whether that means full administrator rights. Even so, an attacker could tamper with websites and data on the server, plant malicious code or use the server as a stepping stone deeper into the network.
- CVSS is a severity scale from 0 to 10. The score of 9.8 (critical, CVSS 3.1) was assigned by VulnCheck, which disclosed the flaw. Under the newer CVSS 4.0, VulnCheck rates it 9.3, which is also critical.
- The CISA KEV catalog lists flaws that the US agency CISA knows are being exploited in real attacks. CVE-2026-77876 is not in it so far.
- EPSS estimates the likelihood of exploitation within the next 30 days. No score is available for this flaw yet.
- The European vulnerability database EUVD, run by ENISA, tracks the flaw as EUVD-2026-115243 and records no exploitation.
Who is affected
This affects anyone running Control Web Panel in a version before 1.16. CWP runs on Red Hat family Linux servers such as AlmaLinux, Rocky Linux or older CentOS. You will typically find it on virtual private servers (VPS), smaller hosting providers, web agencies and company servers used to manage websites, email and databases.
The highest risk applies to servers whose user panel is reachable from the internet, which is common in hosting setups. If you look after a server that an outside contractor set up for you years ago, check whether it runs CWP.
Servers using other panels such as cPanel, Plesk or DirectAdmin are not affected by this flaw. If your website is hosted with a provider who manages the server for you, updating is their job. Ask them whether they use CWP and whether they have already updated it.
How to check if you are affected
In the CWP admin panel (usually on port 2031), the version is shown on the start page. You can also check it on the server from the command line. The commands below change nothing, they only read.
Whether the CWP panel service is running on the server:
systemctl status cwpsrv --no-pagerWhich panel version is installed (look for the webpanel_version value):
grep -rIs "webpanel_version" /usr/local/cwpsrv/htdocs/resources/ | head -n 5Which panel ports are listening on the network (2082 and 2083 are usually the user panel, 2030 and 2031 the admin panel):
ss -tlnp | grep -E ':(2082|2083|2030|2031)\b'If the version is lower than 1.16, the server is vulnerable. If you cannot determine the version with certainty, treat the server as vulnerable.
How to fix it
The fix is to update to version 1.16 or later. On November 3, 2026, the vendor released version 1.30.1, a security and stability update of the LTS branch, and recommends it for every server. Neither the vendor nor VulnCheck lists a separate temporary workaround.
- Check the version on every server running CWP and start with those whose panel is reachable from the internet.
- Take a backup or snapshot of the server before updating.
- If you are already on version 1.30 or later, check the update channel under Settings > CWP Settings > CWP updates in the admin panel. LTS is the default channel, with tested versions that include bug and security fixes.
- Run the update from the admin panel, or as root with the command below.
sh /scripts/update_cwpAfter updating, check the version again and make sure websites, email and the panel work.
Note one change in version 1.30.1: if your mail server still uses the original default trusted networks, the vendor has limited them to the server itself. Applications on other machines in your internal network will then need to log in (SMTP authentication) to send mail.
Until you can update, use the firewall to limit access to the panel ports (2082, 2083, 2030, 2031) to known IP addresses, such as your office or VPN. This is general advice, not an official vendor workaround, and it does not replace the update.
What if you may already be compromised
Neither the vendor nor VulnCheck has published specific indicators of compromise yet. If the vulnerable panel was reachable from the internet, check the server even after updating. The update will not remove anything an attacker may have left behind.
- Panel access logs (usually in
/usr/local/cwpsrv/logs/, including older compressed ones): requests to theprotected_directorymodule from unknown IP addresses, including before November 2, 2026. - Unknown PHP files in website folders (
public_html) that could be web shells. - Unknown cron jobs, unknown accounts and new SSH keys in
authorized_keys. - Unusual processes and outbound connections, such as high CPU load or spam being sent.
- With version 1.30, the vendor notes that CWP does not use
mod_auth_forminhttpd.confand that malware often enables it. It is not directly tied to this flaw, but worth checking.
zgrep -i "protected_directory" /usr/local/cwpsrv/logs/*access* | tail -n 50
grep -n "mod_auth_form" /usr/local/apache/conf/httpd.conf
ls -la /var/spool/cron/ /etc/cron.d/If you find anything suspicious, do not start deleting files on your own. Restrict access to the server, preserve the logs and bring in an incident response specialist.