A critical vulnerability, CVE-2026-57517, has been discovered in the Control Web Panel, categorized with a maximum CVSS score of 9.8. This vulnerability allows unauthenticated remote code execution through blind SQL injection in versions prior to 0.9.8.1225. Administrators are advised to immediately update to this version to prevent exploitation. The flaw exploits the 'userRes' parameter, enabling attackers to execute arbitrary SQL queries with root privileges, posing a significant risk of data breaches.
While no confirmed exploitations have been reported yet, the availability of a public proof-of-concept increases the urgency for mitigation. Key actions include updating systems, auditing server logs, and enhancing firewall rules.