{"metadata": {"vulnerability": "CVE-2026-77876", "count": 16, "kinds": {"milestone": 4, "sighting": 6, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-08-21T15:33:14.171Z", "date_only": false, "value": "2026-08-21T15:33:14.171Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-77876", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-02T00:00:00Z", "date_only": false, "value": "2026-11-02T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-77876", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-02T15:18:18.530Z", "date_only": false, "value": "2026-11-02T15:18:18.530Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-77876", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-02T15:31:43.527Z", "date_only": false, "value": "2026-11-02T15:31:43.527746Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117547542193371483", "record": "CVE-2026-77876", "field": "creation_timestamp", "uuid": "ca296cbc-94bc-4312-9eb0-14fdd682b77a", "content": "CVE-2026-77876 Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can exploit this flaw, which passes attacker-controlled input directly into a shell_exec call, to achieve code execution in the user panel context.\nhttps://www.cve.org/CVERecord?id=CVE-2026-77876https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rcehttps://control-webpanel.com/changeloghttps://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-protected-directory#ControlWebPanel#CVE_2026_77876#bot", "url": "https://infosec.exchange/users/cve/statuses/117547542193371483"}, {"timestamp": "2026-11-02T16:17:43Z", "date_only": false, "value": "2026-11-02T16:17:43Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-94WP-XCC5-C3CM", "record": "GHSA-94WP-XCC5-C3CM", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-02T16:17:43.293Z", "date_only": false, "value": "2026-11-02T16:17:43.293", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77876", "record": "FKIE_CVE-2026-77876", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-02T16:30:06.265Z", "date_only": false, "value": "2026-11-02T16:30:06.265363Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzdqocwspg2n", "record": "CVE-2026-77876", "field": "creation_timestamp", "uuid": "5e904c1d-0f30-493b-adf9-d0b044919dd6", "content": "CVE-2026-77876 - control web panel\nThe Control Web Panel version earlier than 1.16 lets a remote user send specially crafted data to the file upload feature, which the system then runs as a command. This could let an attacker\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzdqocwspg2n"}, {"timestamp": "2026-11-02T18:32:25Z", "date_only": false, "value": "2026-11-02T18:32:25Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-94WP-XCC5-C3CM", "record": "GHSA-94WP-XCC5-C3CM", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T00:00:40.693Z", "date_only": false, "value": "2026-11-03T00:00:40.693043Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117549566479718360", "record": "cve-2026-77876", "field": "creation_timestamp", "uuid": "104d2b3d-d14b-42c5-9afa-2cfe393dc202", "content": "CVE-2026-77876: OS command injection in Control Web Panel (<1.16) \u2013 CRITICAL severity (CVSS 9.3). Remote code execution possible via unescaped POST input. Restrict access & monitor for acc=deletedp abuse. https://radar.offseq.com/threat/cve-2026-77876-cwe-78-os-command-injection-in-control-web-panel-ec9d2cc2044f7ecc #OffSeq #CVE #infosec #vuln", "url": "https://infosec.exchange/users/offseq/statuses/117549566479718360"}, {"timestamp": "2026-11-03T13:28:49.175Z", "date_only": false, "value": "2026-11-03T13:28:49.175433Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/7pxtrikxholla", "record": "CVE-2026-77876", "field": "creation_timestamp", "uuid": "651e9115-a1d3-4bd2-82c6-3b9bbb22f212", "content": "\ud83d\udea8 CVE-2026-77876\nCVSS 9.8 / KEV: No\nTL;DR: Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute\u2026\nhttps://cvesentinel.com/report/CVE-2026-77876\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/7pxtrikxholla"}, {"timestamp": "2026-11-03T15:31:43Z", "date_only": false, "value": "2026-11-03T15:31:43Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-94WP-XCC5-C3CM", "record": "GHSA-94WP-XCC5-C3CM", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-03T16:08:07.302Z", "date_only": false, "value": "2026-11-03T16:08:07.302545Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/censys.bsky.social/post/3mzg7vvimgb2r", "record": "CVE-2026-77876", "field": "creation_timestamp", "uuid": "b1f99adb-a477-494e-af0e-c3f7d15e9817", "content": "\ud83d\udea8 Rapid Response: Critical Control Web Panel command injection (CVE-2026-77876, CVSS 9.8).\n\nCensys identified 443,734 Internet-exposed web properties running CWP. Versions cannot be confirmed, so not all are necessarily vulnerable.\n\nRead the advisory for details and queries: https://bit.ly/4z2loIh", "url": "https://bsky.app/profile/censys.bsky.social/post/3mzg7vvimgb2r"}, {"timestamp": "2026-11-03T17:00:50.149Z", "date_only": false, "value": "2026-11-03T17:00:50.149Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-77876", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-03T17:00:50.149Z", "date_only": false, "value": "2026-11-03T17:00:50.149Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-77876", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-03T17:18:15.570Z", "date_only": false, "value": "2026-11-03T17:18:15.570", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77876", "record": "FKIE_CVE-2026-77876", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-03T21:12:38.764Z", "date_only": false, "value": "2026-11-03T21:12:38.764756Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/censys/statuses/117553360723881176", "record": "cve-2026-77876", "field": "creation_timestamp", "uuid": "f29aff39-15c9-4b9f-8bf0-86bdaee914bb", "content": "\ud83d\udea8 Rapid Response: Critical Control Web Panel command injection (CVE-2026-77876, CVSS 9.8).\nCensys identified 443,734 Internet-exposed web properties running CWP. Versions cannot be confirmed, so not all are necessarily vulnerable.\nRead the full advisory for additional details and queries: https://censys.com/advisory/cve-2026-77876/ \n#Cybersecurity #CensysARC #Vulnerability #CVE202677876 #CommandInjection #ControlWebPanel #AttackSurfaceManagement #ThreatIntelligence #VulnerabilityManagement #WebHosting", "url": "https://infosec.exchange/users/censys/statuses/117553360723881176"}], "metrics": {"as_of": "2026-11-08T01:01:36.012Z", "anchors": {"origin": {"timestamp": "2026-11-02T00:00:00Z", "date_only": false, "value": "2026-11-02T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-77876", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-02T00:00:00Z", "date_only": false, "value": "2026-11-02T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-77876", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 522096.012895, "hours": 145.0266702486111, "days": 6.042777927025463, "min_seconds": 435696.012895, "max_seconds": 522096.012895, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-02T00:00:00Z", "date_only": false, "value": "2026-11-02T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-77876", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-08T01:01:36.012Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}