CVE-2026-65917 usmannasir CVE debrief

Who should care

Administrators and users of CyberPanel, especially those who have installed version 1.9.1 or earlier, should be aware of this vulnerability and take immediate action to patch their systems. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Technical summary

The vulnerability is caused by the use of an attacker-controlled globally sequential IncJob integer ID in the IncBackups application's incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint). This allows authenticated panel users to access or manipulate other tenants' backup resources. The vulnerability has a CVSS score of 8.7 and is classified as HIGH. The vulnerability exists in CyberPanel through 1.9.1, fixed in commit b198460.

Defensive priority

High

Recommended defensive actions

• Apply the patch provided in commit b198460
• Restrict access to the IncBackups application
• Monitor for suspicious activity
• Implement additional security measures to prevent similar vulnerabilities
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was reported by Vulncheck and is described in their advisory. The CVE record was published on 2026-07-23T16:17:55.020Z and last modified on 2026-07-27T17:16:40.893Z. The IncBackups application's incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) are affected. The vulnerability allows authenticated panel users to access or manipulate other tenants' backup resources by supplying an attacker-controlled globally sequential IncJob integer ID that is never re-scoped to the authorized domain.

Official resources