Is there a patch available for CVE-2026-56022?

Yes, a patch is available for CVE-2026-56022. Update the affected software to the latest version immediately.

Webmin CVE-2026-56022

Q: What is the CVSS score of CVE-2026-56022?

CVE-2026-56022 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-37907 MEDIUM

Use of Single-factor Authentication (CWE-308)

2026-06-18 cisa-cg

GHSA-9848-6qgw-2748

Authentication Bypass Webmin

6.9

CVSS 4.0 · Vendor: cisa-cg

Severity by source

Vendor (cisa-cg) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Basic auth credentials required so PR:L not PR:N; Webmin grants full host OS control so C/I/A all high.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (cisa-cg).

CVSS VectorVendor: cisa-cg

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 18, 2026 - 19:38 NVD

5.3 (MEDIUM) 6.9 (MEDIUM)

Patch available

Jun 18, 2026 - 19:01 EUVD

Source Code Evidence Fetched

Jun 18, 2026 - 17:09 vuln.today

Analysis Generated

Jun 18, 2026 - 17:09 vuln.today

DescriptionCVE.org

Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.641.

AnalysisAI

MFA bypass in Webmin prior to 2.641 enables remote attackers holding valid credentials to circumvent multi-factor authentication entirely by supplying the literal string 'webmin' as the HTTP User-Agent header, causing the server to accept basic authentication without requiring a session cookie or a second factor. The affected CPE covers all Webmin releases before 2.641, and the impact extends well beyond the low integrity score assigned by the official CVSS - Webmin is a full server administration panel, meaning successful authentication grants control over the underlying host. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue was reported by CISA-CG and patched in the 2.641 release.

Technical ContextAI

Webmin (cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*) is a browser-based Unix/Linux system administration interface that exposes privileged OS operations over HTTPS. The root cause is classified as CWE-308 (Use of Single-factor Authentication), specifically an authentication downgrade path: the server contains a hard-coded logic branch that, when it detects the 'User-Agent: webmin' string, shifts from its normal session-cookie-plus-MFA flow to plain HTTP Basic Authentication, skipping the second factor entirely. This is effectively a legacy or internal compatibility backdoor in the authentication stack. The vulnerability requires that MFA be enabled on the instance - installations without MFA configured are unaffected by the bypass specifically, though they have no second factor to protect them regardless.

RemediationAI

Upgrade to Webmin 2.641 or later, which is the vendor-released patch per the GitHub release at https://github.com/webmin/webmin/releases/tag/2.641 and the security advisory at https://webmin.com/security/#webmin-prior-to-2641. If immediate upgrade is not possible, restrict access to the Webmin port (default TCP 10000) at the network perimeter to trusted IP ranges only - this limits exposure to attackers who already hold credentials but prevents external exploitation entirely. Additionally, audit all Webmin accounts for signs of credential compromise, since this bypass is only useful to an attacker who already possesses a valid username and password. Blocking or rewriting the 'User-Agent: webmin' header at a reverse proxy or WAF in front of Webmin is a viable short-term compensating control, though it introduces a maintenance dependency on the proxy configuration and may break legitimate Webmin CLI or API tooling that sets this header intentionally.