CVE-2026-6847
Critical
Description
Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload function. The application exposes an endpoint that allows unauthenticated attackers to upload arbitrary PHP files by providing a base64-encoded payload and to execute arbitrary code on the underlying server. This issue has been fixed by a patch released in April 2026.
SeverityCritical
CVSS9.3
Exploit probability—
ProductThemisNETPanel
PublishedJul 13, 2026
First seenJul 13, 2026
Weakness typeCWE-306Missing authentication for critical function
How to fix
Update
- 4real ThemisNETPanel04.2026 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| 4real ThemisNETPanel | v < 04.2026 | 04.2026 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.