Webmin CVE-2026-49243

Requires a victim who is an actively logged-in Webmin user (admin session) to click an attacker-supplied link pointing at their own Webmin instance; the payload is reflected through an unescaped sink such as the 'message' parameter rendered via ui_alert_box()/filter_javascript() in webmin/index.cgi, where the pre-2.650 filter_javascript() failed to neutralize slash-separated and modern HTML5 event handlers. Limiting factors: exploitation needs user interaction (UI:R) and a valid authenticated Webmin session on the target; the attacker needs no credentials of their own (PR:N). No special non-default configuration is indicated - the vulnerable rendering path is in core Webmin. Exploitation is targeted/social-engineering-dependent, not autonomous or wormable.

Signals conflict, and the net real-world urgency is lower than the 9.6 CVSS implies. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) rates this Critical, driven by a scope change and high C/I/A because XSS in the Webmin admin UI can pivot to command execution on a server whose processes typically run as root. However, multiple exploitation-likelihood signals point down: EPSS is only 0.30% (20th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, and CISA's SSVC decision framework rates Exploitation 'none', Automatable 'no', and Technical Impact only 'partial'. The SSVC 'partial' technical impact is notably softer than the CVSS C:H/I:H/A:H total-impact claim - verify scope of compromise with the vendor advisory. Critically, exploitation is not autonomous: it requires a logged-in Webmin user to click an attacker-crafted link (UI:R), so this is a targeted social-engineering vector rather than a mass-automatable remote flaw. Overall: patch promptly given the root-level ceiling, but this is not an emergency drop-everything issue absent evidence of active exploitation.

An attacker crafts a malicious URL to a victim's Webmin server that injects script via a reflected XSS sink (e.g., the 'message' parameter rendered by index.cgi) and sends it to a Webmin administrator. When the authenticated admin clicks the link, the script runs in their session and can drive Webmin's privileged functions to execute attacker-controlled commands on the server. No public exploit identified at time of analysis, so exploitation currently requires the attacker to develop their own payload.