Which versions of ThemisNETPanel are affected by CVE-2026-6847?

Organizations running ThemisNETPanel face immediate risk of complete server compromise through a critical remote code execution vulnerability (CVSS 9.3) accessible to any internet-connected attacker.

How to fix or mitigate CVE-2026-6847?

Within 24 hours, identify all ThemisNETPanel instances and restrict network access through firewall rules and IP whitelisting to authorized users only. Within 7 days, contact vendor 4real to confirm patch availability timeline; deploy Web Application Firewall rules to restrict file uploads and establish monitoring on all upload activity; inventory sensitive data accessible from affected systems. Within 30 days, immediately deploy vendor-released patches upon availability; conduct forensic review of all affected servers for indicators of compromise; implement permanent logging and alerting on upload attempts.

ThemisNETPanel CVE-2026-6847

Q: What is the CVSS score of CVE-2026-6847?

CVE-2026-6847 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-13 CERT-PL

PHP Authentication Bypass RCE File Upload Themisnetpanel

9.3

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable file upload yielding server code execution gives AV:N/AC:L/PR:N/UI:N with full C/I/A impact; scope kept Unchanged as impact is within the vulnerable app's context.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 14:00 vuln.today

CVE Published

Jul 13, 2026 - 13:26 cve.org

CRITICAL 9.3

DescriptionCVE.org

Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload function. The application exposes an endpoint that allows unauthenticated attackers to upload arbitrary PHP files by providing a base64-encoded payload and to execute arbitrary code on the underlying server. This issue has been fixed by a patch released in April 2026.

Articles & Coverage 1

News Critical RCE in PHP ThemisNETPanel (4real) - CVE-2026-6847 Jul 14, 2026

AnalysisAI

Remote code execution in ThemisNETPanel (vendor 4real) allows unauthenticated network attackers to fully compromise the underlying server by abusing a file-upload endpoint that lacks any authentication check. An attacker submits a base64-encoded PHP payload, writes it as an arbitrary PHP file, and executes it in the web application's context. Reported by CERT-PL with a CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is a PHP web application (per the PHP and File Upload tags) exposing a management/upload endpoint. The root cause is CWE-306 (Missing Authentication for a Critical Function): a security-critical operation - arbitrary file write of executable PHP - is reachable without any credential or session check. Because the uploaded content is base64-decoded and written to disk as a .php file within the web root (or a path served by the PHP interpreter), it becomes directly executable, converting an authorization gap into full server-side code execution. The single affected CPE is cpe:2.3:a:4real:themisnetpanel:*:*:*:*:*:*:*:* (all versions prior to the April 2026 fix).

RemediationAI

Apply the vendor patch released in April 2026 (patch available per vendor advisory; an exact fixed version string was not provided in the available data - confirm the target version directly with 4real or via the CERT-PL advisory at https://cert.pl/posts/2026/07/CVE-2026-6847/). Until patched, restrict network reachability of the application: place it behind a VPN or IP allowlist and block direct internet exposure, since the vector is AV:N. As a targeted compensating control, block or require authentication on the specific file-upload endpoint at a reverse proxy or WAF, and deny execution of newly written PHP files in upload directories (e.g., configure the web server so upload paths are not passed to the PHP interpreter) - the trade-off is that legitimate upload/management functionality may break, so validate against normal workflows before enforcing.