Webmin Stored XSS Vulnerability Lets Attackers Exploit Root Users

Gbhackers •Divya • June 24, 2026

A newly disclosed stored cross-site scripting (XSS) vulnerability in Webmin has raised significant security concerns, as it allows attackers with limited privileges to target and potentially compromise root users. This vulnerability, tracked as CVE-2026-22678, affects Webmin versions before 2.641 and resides in the System and Server Status module, a commonly used component for monitoring system […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Webmin Vulnerabilities Enable User Impersonation and Root Access Webmin has disclosed critical vulnerabilities that allow attackers to impersonate any user and potentially gain root-level control. These flaws, affecting versions prior to 2.641, include stored cross-site scripting (XSS) and privilege escalation vulnerabilities. The stored XSS vulnerability, tracked as CVE-2026-22678, was published on 2026-05-21 and can be exploited by users with limited privileges to target root users. The vulnerabilities are present in the System and Server Status module, which is widely utilized for system monitoring. The impact is significant as it exposes systems to unauthorized access and control. Administrators are urged to upgrade to the latest version to mitigate these risks. 2 sources 73

Extracted Entities

Webmin Stored XSS Vulnerability Lets Attackers Exploit Root Users

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)