Between October 30 and November 2, 2026, NVD published four critical CVEs in platforms you install and run yourself: the hosting panel Control Web Panel (CWP), the open source core banking platform Apache Fineract, and two admin application frameworks, ape-volo-admin and madong-admin-saas.
Four unrelated products with the same outcome: an attacker takes over the application, through a shell command, a SQL query, a forged admin token or an API that was never locked down.
| Product | CVE | Flaw class | CVSS 3.1 (source) | Bounds |
|---|---|---|---|---|
| Control Web Panel | CVE-2026-77876 | OS command injection | 9.8 (VulnCheck) | before webpanel_version 1.16 |
| Apache Fineract | CVE-2026-64618 | SQL injection | 9.8 (NVD) | through 1.15.0; fix announced in 1.16.1 |
| ape-volo-admin | CVE-2026-120442 | Hard-coded JWT signing key | 9.8 (VulnCheck) | before 3.6.1 |
| madong-admin-saas | CVE-2026-120446 | Missing authentication | 9.4 (VulnCheck) | up to and including 5.1.4 |
Only the Fineract CVE has been analyzed by NVD (status Analyzed). The other three come from VulnCheck as CNA and are in status Deferred: NVD doesn't plan to analyze them. None is in CISA KEV at the time of writing.
Control Web Panel — CVE-2026-77876
CWP (formerly CentOS Web Panel) is a free hosting panel widely deployed on dedicated servers and VPSs. The user panel's protected_directory module passes the file POST parameter of the acc=deletedp action straight into a shell_exec call: arbitrary command execution in the user panel context.
| Field | Value |
|---|---|
| CVSS 3.1 | 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (VulnCheck) |
| CVSS 4.0 | 9.3 (VulnCheck) |
| CWE | CWE-78 (OS command injection) |
| Versions | before webpanel_version 1.16 |
The vector says PR:N, yet the flaw lives in the user panel, and the description doesn't say whether a hosted-user session is required. On a shared server, even if it is, every customer on the box becomes an entry point.
Action: upgrade CWP to webpanel_version 1.16 or later (the CWP changelog is referenced) and keep the panel ports off the internet.
Apache Fineract — CVE-2026-64618
Fineract is the Apache Software Foundation's open source core banking system, used for microfinance and financial services. The outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance endpoint is open to SQL injection.
| Field | Value |
|---|---|
| CVSS 3.1 | 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD) |
| CWE | CWE-89 (SQL injection) |
| Versions | through 1.15.0 per the description |
| Fix | 1.16.1, as recommended by Apache |
NVD's CPE configuration sets the bound at "below 1.16.0", while the Apache advisory recommends 1.16.1: go with 1.16.1. In a database holding accounts and loans, SQL injection means reading and altering financial records.
Action: upgrade to 1.16.1 and, until then, filter /search/advance at the reverse proxy.
ape-volo-admin — CVE-2026-120442
An open source .NET admin framework. The JWT signing key is hard-coded in appsettings.json, identical on every install that never changed it. An attacker signs a token offline with the jti claim set to the seeded administrator's id and gets full API control: users, roles, permissions, data.
| Field | Value |
|---|---|
| CVSS 3.1 | 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (VulnCheck) |
| CVSS 4.0 | 9.3 (VulnCheck) |
| CWE | CWE-1394 (default cryptographic key) |
| Versions | before 3.6.1 |
Action: upgrade to 3.6.1 and, above all, replace the signing key with a random per-instance value. As long as the key from the public repository is in place, upgrading alone may not be enough.
madong-admin-saas — CVE-2026-120446
A PHP multi-tenant SaaS framework. The platformapi middleware key never matches the platform application, so authentication never applies to the tenant management API. Without an account, anyone can call /platformapi/tenant/account, bind-plan and sync-data to list, create, modify, disable or delete tenants and bind subscription plans to them.
| Field | Value |
|---|---|
| CVSS 3.1 | 9.4, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H (VulnCheck) |
| CVSS 4.0 | 8.8 (VulnCheck) |
| CWE | CWE-306 (missing authentication) |
| Versions | up to and including 5.1.4 |
NVD doesn't name a fixed release; a project commit is referenced.
Action: apply the fix commit, or block /platformapi/ at the reverse proxy for any non-admin source.
Detection
- CWP: requests to the
protected_directorymodule withacc=deletedpand afileparameter containing;,|,$(or backticks; unexpected shell processes spawned by the panel user. - Fineract: calls to
/search/advancewith non-numeric values inoutStandingAmountPercentageCondition, SQL errors in application logs. - ape-volo-admin: check whether the JWT key in
appsettings.jsonis the one from the repository; admin logins from unknown IPs. - madong-admin-saas: unauthenticated calls to
/platformapi/tenant/*, tenants created or changed outside your process.
For more self-hosted takeovers from the past few days, see our article on AJ-Report, Jpom, LMDeploy and three other projects.
Mitigation
- Upgrade CWP to 1.16 or later, Fineract to 1.16.1, ape-volo-admin to 3.6.1; apply the madong-admin-saas commit.
- Replace default secrets (ape-volo-admin's JWT key), which also invalidates existing tokens.
- Keep admin interfaces off the internet: VPN, IP allowlist or an authenticating proxy.
- If an instance was exposed: audit admin accounts, tenants and, for Fineract, recent transactions.
Why Continuous Monitoring of Your Self-Hosted Platforms Matters
Three of these four CVEs will never be analyzed by NVD. Monitoring that relies on CPE matches alone won't see them, even though they're rated 9.4 to 9.8.
With cveo.tech, add the platforms you run to your inventory, with their versions, and get alerted as soon as a CVE names them, even before NVD analyzes it.