# CWP2Shell: update Control Web Panel and restrict panel access

Canonical: https://www.oktsec.com/radar/control-web-panel-cwp2shell
Publisher: Oktsec
Language: en
Published: 2026-11-04T09:56:42Z
Updated: 2026-11-04T09:56:42Z
Record reviewed: 2026-11-04T09:56:42Z
Latest evidence check: 2026-11-04T09:56:42Z
Disclosed: 2026-11-03

VulnCheck demonstrated a chain from the hosting panel to root access, with a valid hosting username needed for entry without a password. Real-world attacks using these ten CVEs have not been established in the reviewed sources.

## Evidence and response priority

- Category: Vulnerability
- Oktsec priority: Act now
- Rationale: A working research chain reaches root on affected builds. Internet-accessible panels warrant immediate remediation; this priority does not imply confirmed attacks in the wild.
- Evidence: Attacks not established
- Verification: Multiple sources
- Fix status: Fix available
- Exposure requirement: Application or configuration dependent
- Vendor: Control Web Panel
- Products: Control Web Panel
- CVEs: CVE-2026-73695, CVE-2026-73696, CVE-2026-73697, CVE-2026-77876, CVE-2026-77877, CVE-2026-77878, CVE-2026-77879, CVE-2026-77880, CVE-2026-77881, CVE-2026-104080

## Technical overview

The demonstrated path starts at the user panel and reaches a privileged internal API. A valid hosting account name is a prerequisite for the password-free entry. The API is bound to loopback; it is not a separate public entry point.

Fixes arrived in stages. The CNA ranges below identify each group; do not interpret every build before 1.29 as remotely exploitable without authentication. VulnCheck reports all ten corrected by 1.29 and checked 1.30 for regressions. The vendor subsequently recommended the 1.30.1 security release.

Known exploitation of the older CVE-2025-48703 does not establish attacks using these ten CVEs. Oktsec recommends treating the demonstrated chain as an urgent exposure and patching decision, with investigation driven by local evidence.

## Recommended response

Install the vendor-recommended 1.30.1 security update or a later supported release, restrict access to the panels and verify the installed webpanel build.

Relevant to: Hosting providers and teams administering servers with Control Web Panel, particularly internet-accessible panels.

## CVE attribution

- CVE-2026-73695: Control Web Panel — Control Web Panel. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/73xxx/CVE-2026-73695.json)
- CVE-2026-73696: Control Web Panel — Control Web Panel. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/73xxx/CVE-2026-73696.json)
- CVE-2026-73697: Control Web Panel — Control Web Panel. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/73xxx/CVE-2026-73697.json)
- CVE-2026-77876: Control Web Panel — Control Web Panel. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77876.json)
- CVE-2026-77877: Control Web Panel — Control Web Panel. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77877.json)
- CVE-2026-77878: Control Web Panel — Control Web Panel. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77878.json)
- CVE-2026-77879: Control Web Panel — Control Web Panel. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77879.json)
- CVE-2026-77880: Control Web Panel — Control Web Panel. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77880.json)
- CVE-2026-77881: Control Web Panel — Control Web Panel. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77881.json)
- CVE-2026-104080: Control Web Panel — Control Web Panel. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104080.json)

## Exploit demonstration

Status: Exploit demonstrated
CVEs: CVE-2026-73695, CVE-2026-73696, CVE-2026-73697, CVE-2026-77876, CVE-2026-77877, CVE-2026-77878, CVE-2026-77879, CVE-2026-77880, CVE-2026-77881, CVE-2026-104080
Checked: 2026-11-04T09:49:59Z

Research demonstrated the CWP2Shell chain on CWP7 webpanel 1.8. The password-free entry requires a valid hosting username and was closed in 1.12; later affected builds require hosting-account access for the remaining escalation paths. This is not evidence of attacks in the wild.

[Supporting source](https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce)

## Affected systems and fixes

### CWP webpanel — CVE-2026-73696

Affected: Before 1.12: authentication-flow flaw enabling password-free entry with a valid hosting username.

Fixed release / action: 1.12 closes this entry; use 1.30.1 or a later supported security release

### CWP webpanel — CVE-2026-73695, CVE-2026-73697, CVE-2026-77876, CVE-2026-77879, CVE-2026-77880

Affected: Before 1.16, according to the individual CNA records. Closing the entry in 1.12 does not fix all downstream flaws.

Fixed release / action: 1.16 fixes this group; use 1.30.1 or a later supported security release

### CWP webpanel — CVE-2026-77877, CVE-2026-77878, CVE-2026-77881, CVE-2026-104080

Affected: Before 1.29, according to the CNA records; hosting-account access can reach remaining user API escalation paths.

Fixed release / action: 1.29 completes the ten-CVE fixes; use 1.30.1 or a later supported security release

Confirm the running version against the vendor advisory, including any distribution backports.

## CISA KEV evidence

Catalog: 2026.11.03
Checked: 2026-11-03T22:13:58Z

No matching CVE appears in the reviewed catalog snapshot.

CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America.

## Supporting evidence

Snapshot checked: 2026-11-04T12:33:51.947Z. These dates do not change the incident’s editorial review date.

### FIRST EPSS forecast

- [CVE-2026-77881](https://api.first.org/data/v1/epss?cve=CVE-2026-77881): 0.21% probability of observed exploitation in the next 30 days; percentile 10.99%; score date 2026-11-03.
- [CVE-2026-77880](https://api.first.org/data/v1/epss?cve=CVE-2026-77880): 0.78% probability of observed exploitation in the next 30 days; percentile 55.84%; score date 2026-11-03.
- [CVE-2026-77879](https://api.first.org/data/v1/epss?cve=CVE-2026-77879): 0.23% probability of observed exploitation in the next 30 days; percentile 14.12%; score date 2026-11-03.
- [CVE-2026-77878](https://api.first.org/data/v1/epss?cve=CVE-2026-77878): 0.84% probability of observed exploitation in the next 30 days; percentile 58.01%; score date 2026-11-03.
- [CVE-2026-77877](https://api.first.org/data/v1/epss?cve=CVE-2026-77877): 0.18% probability of observed exploitation in the next 30 days; percentile 7.72%; score date 2026-11-03.
- [CVE-2026-77876](https://api.first.org/data/v1/epss?cve=CVE-2026-77876): 2.16% probability of observed exploitation in the next 30 days; percentile 82.21%; score date 2026-11-03.
- [CVE-2026-73697](https://api.first.org/data/v1/epss?cve=CVE-2026-73697): 1.63% probability of observed exploitation in the next 30 days; percentile 76.27%; score date 2026-11-03.
- [CVE-2026-73696](https://api.first.org/data/v1/epss?cve=CVE-2026-73696): 0.52% probability of observed exploitation in the next 30 days; percentile 43.96%; score date 2026-11-03.
- [CVE-2026-73695](https://api.first.org/data/v1/epss?cve=CVE-2026-73695): 0.66% probability of observed exploitation in the next 30 days; percentile 51.68%; score date 2026-11-03.
- [CVE-2026-104080](https://api.first.org/data/v1/epss?cve=CVE-2026-104080): 1.23% probability of observed exploitation in the next 30 days; percentile 68.91%; score date 2026-11-03.

EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-04T12:33:51.947Z.

## Response checklist

1. **Identify the installed panel build** — Record the internal webpanel version, hosting accounts and network reachability. A CWP7 label alone is not a patch level.
2. **Apply the supported security update** — Use the official update procedure for 1.30.1 or a later supported release. Verify the installed build and panel operation after the change; do not stop at an intermediate fix.
3. **Limit who can reach the panels** — Place user and administration panels behind an allowlist or controlled remote access where practical. Review exceptions with hosting customers and administrators.
4. **Check for earlier unauthorized activity** — Oktsec recommends reviewing unexpected privileged processes, account changes, panel access and modified web content. If suspicious activity is found, preserve evidence and escalate to incident response; an update does not establish that a host is clean.

## Relevance to AI environments

Oktsec recommends including hosted agent services and their credentials in the impact review: root access can cross application and tenant boundaries.

## Sources

- [CWP2Shell: research demonstration and staged fixes](https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce) — VulnCheck; Research report; checked 2026-11-04T09:49:59Z
- [Control Web Panel: security release 1.30.1](https://control-webpanel.com/changelog) — Control Web Panel; Vendor notice; checked 2026-11-04T09:49:59Z
- [CVE-2026-73695: CNA affected range](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/73xxx/CVE-2026-73695.json) — VulnCheck CNA; Research report; checked 2026-11-04T09:49:59Z
- [CVE-2026-73696: CNA affected range](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/73xxx/CVE-2026-73696.json) — VulnCheck CNA; Research report; checked 2026-11-04T09:49:59Z
- [CVE-2026-73697: CNA affected range](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/73xxx/CVE-2026-73697.json) — VulnCheck CNA; Research report; checked 2026-11-04T09:49:59Z
- [CVE-2026-77876: CNA affected range](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77876.json) — VulnCheck CNA; Research report; checked 2026-11-04T09:49:59Z
- [CVE-2026-77877: CNA affected range](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77877.json) — VulnCheck CNA; Research report; checked 2026-11-04T09:49:59Z
- [CVE-2026-77878: CNA affected range](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77878.json) — VulnCheck CNA; Research report; checked 2026-11-04T09:49:59Z
- [CVE-2026-77879: CNA affected range](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77879.json) — VulnCheck CNA; Research report; checked 2026-11-04T09:49:59Z
- [CVE-2026-77880: CNA affected range](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77880.json) — VulnCheck CNA; Research report; checked 2026-11-04T09:49:59Z
- [CVE-2026-77881: CNA affected range](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77881.json) — VulnCheck CNA; Research report; checked 2026-11-04T09:49:59Z
- [CVE-2026-104080: CNA affected range](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104080.json) — VulnCheck CNA; Research report; checked 2026-11-04T09:49:59Z

## Editorial record

- 2026-11-04T09:56:42Z: Added source-backed scope, evidence distinctions and response guidance.

## Use this advisory in Radar

Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment.

[Open advisory](https://www.oktsec.com/radar/control-web-panel-cwp2shell) · [Build a response plan](https://www.oktsec.com/radar/control-web-panel-cwp2shell#review-workspace)

- [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=control-web-panel-cwp2shell&service=exposure_check)
- [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=control-web-panel-cwp2shell&service=patch_verification)

## Scope and corrections

Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure.

[Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.