CVE-2026-6847— Unauthenticated Remote Code Execution in ThemisNETPanel
Quick assessment
Affected
4real ThemisNETPanel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
4real ThemisNETPanel是4real公司的一个Web管理面板系统。 4real ThemisNETPanel 04.2026之前版本存在授权问题漏洞，该漏洞源于缺少对关键文件上传功能的身份验证，可能导致未经身份验证的攻击者上传任意PHP文件并在底层服务器上执行任意代码。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| 4real | ThemisNETPanel | < 04.2026 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-6847
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unauthenticated Remote Code Execution in ThemisNETPanel
Source: CVE Program / CVE List V5
Vulnerability Description
Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload function. The application exposes an endpoint that allows unauthenticated attackers to upload arbitrary PHP files by providing a base64-encoded payload and to execute arbitrary code on the underlying server. This issue has been fixed by a patch released in April 2026.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
4real ThemisNETPanel 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
4real ThemisNETPanel是4real公司的一个Web管理面板系统。 4real ThemisNETPanel 04.2026之前版本存在授权问题漏洞，该漏洞源于缺少对关键文件上传功能的身份验证，可能导致未经身份验证的攻击者上传任意PHP文件并在底层服务器上执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| 4real | ThemisNETPanel | 0 ~ 04.2026 | - |
|
II. Public POCs for CVE-2026-6847
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-6847
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-6847 (1)
-
🔗 Podatność w oprogramowaniu 4real ThemisNETPanel | CERT Polska third-party-advisory
IV. Related Vulnerabilities
Same weakness: CWE-306
-
CVE-2026-79977
WireGuard peer endpoint learned from unauthenticated transpo -
CVE-2026-55463
Goobi viewer: WebSocket endpoints lack server-side authentic -
CVE-2026-46651
Unauthenticated SSRF and local file inclusion via DownloadTa -
CVE-2026-57207
NetBox MCP Server: HTTP transport exposes all NetBox data wi -
CVE-2026-114357
DJI CrystalSky ZS600C ships ADB without authentication (ro.a
V. Comments for CVE-2026-6847
No comments yet