Is CVE-2026-41473 actively exploited?

No active exploitation of CVE-2026-41473 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-41473 be exploited remotely?

Yes. CVE-2026-41473 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-41473?

CVE-2026-41473 has a CVSS score of 9.1 (CRITICAL).

HOME VULNERABILITIESCVE-2026-41473

CRITICAL

CVE-2026-41473

CWE-306Published: April 24, 2026· Updated: Apr 28, 2026

9.1

CVSS v3.1

EPSS:0.21%probability of exploitation in 30 daysPercentile:43.8th

Official Description

CyberPanel versions prior to 2.4.4 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the database by sending requests to the /api/ai-scanner/status-webhook and /api/ai-scanner/callback endpoints. Attackers can exploit the lack of authentication checks to cause denial of service through storage exhaustion, corrupt scan history records, and pollute database fields with malicious data.

NVD Source

Technical Analysis

CVE-2026-41473 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.1.