HestiaCP versions 1

CVE-2026-43633 is an *unauthenticated root RCE* in HestiaCP's web terminal path. Affected builds are HestiaCP 1.9.0 through 1.9.4, where PHP writes session data in its serialized format and the Node.js terminal component reads that same file with naive string splitting; an attacker can poison session content through headers, then hit /_shell/ and have the terminal believe the session user is root.

The vendor's 10.0 is directionally right on *impact*, but too absolute on *population*. This is not every HestiaCP box: the web terminal is an optional feature, and external reachability to port 8083 matters. That said, once the feature is enabled on an internet-reachable admin panel, the attack is brutally low-friction, produces a root PTY, and there is public compromise evidence from operators—so this stays CRITICAL, just not a universal 10.0.

Why this verdict

• Baseline down from 10.0 because exposure is feature-gated: this is not every HestiaCP instance; the optional web terminal must be present, and Mercury estimated only about 10–15% of public HestiaCP instances had it enabled.
• Stayed CRITICAL because attacker position is still unauthenticated remote: no creds, no user interaction, no prior foothold, and the end state is a root PTY on an internet-administered host.
• Active exploitation evidence overrides the low EPSS mood music: public operator reports show root terminal access and persistence activity on real servers around May 21–22, 2026.

Why not higher?

I did not leave this at a perfect 10.0 because the reachable population is narrower than the CVSS vector implies. Requiring the web terminal feature and, in practice, exposure of the Hestia admin plane means this is not the kind of bug that automatically applies to every Hestia footprint you own.

Why not lower?

Anything that gives unauthenticated remote attackers a root shell on the box does not belong below CRITICAL once it is internet-reachable. The combination of simple exploit flow, full-host blast radius, and public compromise evidence kills any argument for treating this as a mere high-priority configuration issue.

1. Disable the web terminal — Run v-delete-sys-web-terminal or turn the plugin off in the Hestia UI. This removes the vulnerable execution path entirely and, because there is public compromise evidence, deploy this immediately, within hours rather than waiting for a maintenance window.
2. Restrict port 8083 — Put the Hestia control plane behind VPN, bastion, or explicit source-IP allowlists at the firewall/load balancer. Even if you cannot patch the host immediately, shrinking exposure on the admin surface is the fastest compensating control and should also happen immediately, within hours.
3. Hunt for post-exploitation artifacts — Review journalctl -u hestia-web-terminal.service, Hestia nginx access logs, /root/.ssh/authorized_keys, /etc/ld.so.preload, and newly dropped shared objects under /lib and /usr/lib. Do this immediately, within hours on any host that ever exposed the web terminal, because the reported attacker behavior included persistence rather than smash-and-grab only.
4. Rotate root and service access material on suspected hosts — If there is any sign of exploitation, treat the host as fully compromised: rotate SSH keys, panel credentials, database secrets, API tokens, and mail credentials after containment. This is a containment follow-on, not optional hygiene, and it should begin immediately, within hours for suspected systems.

Run this on the target HestiaCP host as root or via sudo so it can inspect package metadata, service state, and the web-terminal files. Example: sudo bash ./check-cve-2026-43633.sh; it prints VULNERABLE, PATCHED, or UNKNOWN and exits non-zero on vulnerable/unknown findings.

#!/usr/bin/env bash
# check-cve-2026-43633.sh
# Detect likely exposure to CVE-2026-43633 on a HestiaCP host.
# Exit codes:
#   0 = PATCHED / not affected
#   1 = VULNERABLE
#   2 = UNKNOWN / could not determine

set -u

have_cmd() { command -v "$1" >/dev/null 2>&1; }

get_pkg_ver() {
  local pkg="$1"
  if have_cmd dpkg-query; then
    dpkg-query -W -f='${Version}' "$pkg" 2>/dev/null | sed 's/:.*//'
  else
    return 1
  fi
}

ver_ge() {
  # returns 0 if $1 >= $2
  dpkg --compare-versions "$1" ge "$2"
}

ver_lt() {
  # returns 0 if $1 < $2
  dpkg --compare-versions "$1" lt "$2"
}

HVER="$(get_pkg_ver hestia || true)"
WTPKGVER="$(get_pkg_ver hestia-web-terminal || true)"
WTDIR="/usr/local/hestia/web-terminal"
SERVERJS="$WTDIR/server.js"
HELPER="$WTDIR/web-terminal-session-auth.php"

wt_installed="no"
wt_enabled="no"
vuln_parser_present="no"
helper_present="no"

if [ -n "$WTPKGVER" ] || [ -d "$WTDIR" ] || systemctl list-unit-files 2>/dev/null | grep -q '^hestia-web-terminal.service'; then
  wt_installed="yes"
fi

if systemctl is-enabled hestia-web-terminal >/dev/null 2>&1 || systemctl is-active hestia-web-terminal >/dev/null 2>&1; then
  wt_enabled="yes"
fi

if [ -f "$SERVERJS" ] && grep -Fq "split('user|s:'" "$SERVERJS" 2>/dev/null; then
  vuln_parser_present="yes"
fi

if [ -f "$HELPER" ]; then
  helper_present="yes"
fi

# No Hestia package found
if [ -z "$HVER" ]; then
  echo "UNKNOWN: Hestia package version not found"
  exit 2
fi

# Fixed train
if ver_ge "$HVER" "1.9.5"; then
  echo "PATCHED: Hestia version $HVER is on the fixed train (1.9.5+)"
  exit 0
fi

# Pre-vulnerable train
if ver_lt "$HVER" "1.9.0"; then
  echo "PATCHED: Hestia version $HVER is below the affected range (1.9.0-1.9.4)"
  exit 0
fi

# Affected train 1.9.0-1.9.4
if ver_ge "$HVER" "1.9.0" && ver_lt "$HVER" "1.9.5"; then
  if [ "$wt_installed" = "yes" ] || [ "$wt_enabled" = "yes" ] || [ "$vuln_parser_present" = "yes" ]; then
    echo "VULNERABLE: Hestia $HVER with web terminal present/enabled on affected train"
    exit 1
  fi

  if [ "$helper_present" = "yes" ]; then
    echo "UNKNOWN: Hestia $HVER is affected train, but helper file exists unexpectedly; verify packaging state manually"
    exit 2
  fi

  echo "PATCHED: Hestia $HVER is in affected range, but web terminal does not appear installed/enabled"
  exit 0
fi

echo "UNKNOWN: unable to classify host state"
exit 2

Sources

1. Mercury ISS advisory
2. HestiaCP GitHub releases
3. HestiaCP forum: Web Terminal Hack
4. HestiaCP forum: 1.9.5 release discussion
5. Patched session auth helper in upstream source
6. CISA Known Exploited Vulnerabilities catalog
7. FIRST EPSS API documentation
8. Tenable CVE entry