CyberPanel EUVD-2026-25631

Exploitation requires only network reachability to a CyberPanel instance running a version below 2.4.4 with the AI Scanner worker API endpoints (/api/ai-scanner/status-webhook and /api/ai-scanner/callback) exposed - these are the exact features that lack authentication. No credentials, user interaction, or non-default configuration is indicated (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N), so default installs that expose the panel to untrusted networks are directly at risk. The primary limiting factor is network exposure: instances reachable only over a restricted internal network, VPN, or behind IP allow-listing / a WAF blocking those endpoints are not remotely exploitable by outsiders. Impact is bounded to integrity and availability (database pollution and storage-exhaustion DoS); there is no confidentiality/data-disclosure impact per the vector.

Signals are moderately consistent but not uniformly alarming. The CVSS 4.0 base is 8.8 (High) driven by network vector, low complexity, no privileges, no user interaction, and high integrity and availability impact (VI:H/VA:H) with no confidentiality impact (VC:N) - matching a write/DoS-only flaw rather than data theft or code execution. SSVC reinforces urgency: exploitation is 'poc', the attack is 'automatable: yes', and technical impact is 'total'. However, EPSS is only 0.21% (44th percentile), and there is no CISA KEV listing, indicating no confirmed in-the-wild campaign yet despite public exploit code. Note a naming caveat: the public exploit writeup is titled 'cyberpanel-rce', but the CVE description and CVSS impact metrics describe integrity/availability abuse (database pollution and storage-exhaustion DoS), not remote code execution - treat any RCE claim as unverified against the scored impact. Net: a real, easily automatable exposure for internet-facing panels that should be patched promptly, but current evidence points to opportunistic/targeted rather than mass exploitation.

An attacker locates an internet-facing CyberPanel instance and, without any credentials, sends a flood of crafted POST requests to /api/ai-scanner/status-webhook and /api/ai-scanner/callback. Each request writes attacker-controlled data into the database, letting them exhaust storage to cause denial of service and corrupt or pollute scan-history and related records. A public exploit writeup exists (https://itsrez.re/post/cyberpanel-rce) and the low-complexity, unauthenticated nature makes the attack trivially scriptable.