Critical Vulnerability Disclosed in aaPanel Allowing Remote Command Injection

• •CVE-2026-101009 allows remote OS command injection in aaPanel versions up to 11.8.0.
• •The vulnerability was disclosed publicly, increasing the urgency for affected systems to be reviewed.
• •No response from the vendor has been reported, raising concerns about timely mitigation.

A high-risk vulnerability, CVE-2026-101009, was identified in aaPanel up to version 11.8.0, affecting the unzip functionality that could lead to OS command injection. The flaw allows remote attackers to manipulate the password argument, potentially compromising the host system and disrupting services. The vendor was contacted but did not respond to the disclosure. The vulnerability has been publicly disclosed, and while there is no indication of active exploitation, the risk remains significant for exposed management panels, especially on shared hosting environments. Security professionals are urged to review logs for unusual activity and restrict access to the affected panels. The vulnerability was officially published on September 28, 2026.