Skip to content
Threat Feed

Product

HestiaCP 1.9.4

1 brief RSS
critical threat

HestiaCP Deserialization Vulnerability (CVE-2026-43633)

HestiaCP versions 1.9.0 through 1.9.4 are vulnerable to unauthenticated remote code execution due to a deserialization flaw in the web terminal component (CVE-2026-43633), stemming from a session format mismatch between PHP and Node.js, allowing attackers to inject malicious data via HTTP headers.

HestiaCP 1.9.0 +4 deserialization rce cve
2r 1t 1c