Webmin EUVD-2026-37909

Target must be running Webmin prior to 2.641 with SSL client-certificate authentication enabled in miniserv.pl - this is a non-default authentication mode that an administrator must explicitly configure, and it is the AT:P (Attack Requirements: Present) factor in the CVSS 4.0 vector. miniserv.pl must be network-reachable by the attacker (typically TCP/10000 HTTPS). No prior authentication, no user interaction, and no privileges on the target are required (PR:N/UI:N); the attacker only needs to send a single crafted HTTPS request with the forged certificate-DN header and know (or guess from common conventions like 'root' or 'admin') a valid Webmin username to impersonate. Deployments using only password-based or 2FA authentication, or deployments where miniserv.pl is not exposed to the attacker's network segment, are not exploitable via this flaw.

Signals largely agree that this is a high-priority issue: CVSS 4.0 9.2 with AV:N/AC:L/PR:N/UI:N reflects a network-reachable, unauthenticated, low-complexity bypass against the admin plane of a privileged management product, with full confidentiality, integrity, and availability impact on the vulnerable system. The AT:P (Attack Requirements: Present) metric is the key qualifier - exploitation requires that the target Webmin instance be configured to use SSL client-certificate authentication, which is a non-default deployment choice and meaningfully narrows the exposed population. CISA Vulnrichment (cisa-cg) involvement and EUVD tracking lend credibility, but the vulnerability is NOT in CISA KEV and no POC has been published in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' EPSS is not provided. Net: for any organization that exposes Webmin with client-cert auth, treat as critical and patch immediately; for default password-auth deployments, urgency is lower but patching is still warranted given Webmin's history of being internet-exposed and targeted.

A Webmin instance is reachable on the internet (port 10000/tcp) and configured to accept SSL client-certificate authentication for administrative SSO. An attacker connects over HTTPS and injects an HTTP header carrying a forged Distinguished Name matching the root or an existing admin user (e.g., 'CN=root,OU=Admins'); miniserv.pl trusts the header value rather than the TLS-validated peer certificate and grants a session as that user, yielding full Webmin admin control and, by extension, root-equivalent command execution on the underlying host. No public exploit has been identified at time of analysis, but the attack is trivially scriptable with curl once the header name is known.