Unauthenticated RCE patched in ThemisNETPanel
CERT Polska coordinated disclosure of CVE-2026-6847, an unauthenticated file-upload flaw in 4real ThemisNETPanel allowing arbitrary PHP code execution, patched in April 2026.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska disclosed CVE-2026-6847, a remote code execution vulnerability in 4real ThemisNETPanel software stemming from a missing authentication check on a critical file upload endpoint. The flaw allows unauthenticated attackers to submit a base64-encoded payload containing an arbitrary PHP file, which is then written to the server and can be executed to gain full remote code execution on the underlying host.
The vulnerability was reported through CERT Polska's coordinated vulnerability disclosure (CVD) process, credited to researchers Kamil Szczurowski and Robert Kruczek. A vendor patch was released in April 2026, prior to this public advisory, reducing the window of exposure for organizations that have applied updates. No evidence of in-the-wild exploitation is mentioned in the report, and the disclosure appears to be a standard responsible-disclosure notice rather than an active attack campaign.
Mentioned in this report
Detection guidance
Web Server Process Spawning Command Shell (Possible Webshell Execution)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a web server or PHP-FPM process spawning a system shell, consistent with post-upload execution of a malicious PHP file dropped via an unauthenticated file-upload RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Command Shell
description: Detects apache/nginx/php-fpm processes spawning shell interpreters, a
common post-exploitation behaviour after an unauthenticated file-upload RCE (e.g.
CVE-2026-6847) drops and executes a PHP webshell.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /httpd
- /apache2
- /nginx
- /php-fpm
- /php-fpm7
- /php-fpm8
Image|endswith:
- /sh
- /bash
- /dash
- /python
- /perl
- /curl
- /wget
- /nc
filter_package_mgmt:
CommandLine|contains:
- apt-get
- dpkg
- yum
- systemctl
condition: selection and not filter_package_mgmt
falsepositives:
- Legitimate CGI scripts or admin panels that shell out to system utilities
- Server management scripts triggered through web hooks
level: high
id: 9d380a40-1115-5e43-aa52-a5995c27c5d4
status: experimental
author: Vorant
New PHP File Written by Web Server Process in Web Root
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a web server / PHP-FPM process account creating a new .php file inside typical webroot directories, consistent with an arbitrary file upload RCE writing an attacker-controlled PHP payload to disk. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: New PHP File Written by Web Server Process
description: Detects creation of new .php files by the web server or PHP-FPM process/user
in common webroot paths, which is the file-drop step of an unauthenticated file-upload
RCE like CVE-2026-6847.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|endswith: .php
TargetFilename|contains:
- /var/www/
- /htdocs/
- /public_html/
- /wp-content/uploads/
filter_deploy:
Image|endswith:
- /composer
- /git
- /rsync
- /scp
condition: selection and not filter_deploy
falsepositives:
- Legitimate deployment pipelines writing PHP application code to the webroot
- CMS plugin/theme installers that write PHP files at runtime
level: medium
id: d235f1a7-744e-5d07-bedd-9374f21b3d62
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-6847
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,570 reports from 147 sources, 725 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs