Vulnerability intelligence

CVE-2026-56020

The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. A remote attacker can spoof certificate DNs and authenticate as any user. Fixed in 2.202.

CVSS Score

9.2

Critical

EPSS — Exploit Probability

0.5%

Riskier than 41% of all CVEs · checked 2026-09-21

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

unknown

Check vendor advisories