CVE-2026-6847CWE-306

Unauthenticated Remote Code Execution in ThemisNETPanel

Critical · published July 13, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
58.7
In the wild
Unconfirmed
What it is

Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload function. The application exposes an endpoint that allows unauthenticated attackers to upload arbitrary PHP files by providing a base64-encoded payload and to execute arbitrary code on the underlying server. This issue has been fixed by a patch released in April 2026.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
EPSS
0.00879 · 58.7th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-07-13T13:26Z
EPSS history
Timeline
  • 13 JUL 13:26Z
    Unauthenticated Remote Code Execution in ThemisNETPanel
    cvelistv5