Cyber Resilience

CVE-2026-29205

High

Published: 13 May 2026

Published
13 May 2026
Modified
14 May 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
EPSS Score 0.0724 93.6th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-29205 is a high-severity Execution with Unnecessary Privileges (CWE-250) vulnerability in Cpanel (inferred from references). Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

CWE(s)
CWE-250

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

Arbitrary file read via insufficient path filtering on public cpdavd web endpoint directly enables T1190 exploitation of public-facing application and subsequent T1005 local data access.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-7102Shared CWE-250
CVE-2026-42833Shared CWE-250
CVE-2025-34274Shared CWE-250
CVE-2026-4498Shared CWE-250
CVE-2025-13375Shared CWE-250
CVE-2025-34515Shared CWE-250
CVE-2025-33223Shared CWE-250
CVE-2026-25212Shared CWE-250
CVE-2024-12673Shared CWE-250
CVE-2025-40942Shared CWE-250

Affected Assets

Cpanel
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-1 Policy and Procedures
addresses: CWE-250

Policy promotes least privilege by defining necessary privileges and management commitment to them.

AC-13 Supervision and Review — Access Control
addresses: CWE-250

Supervision detects and allows removal of unnecessary privileges that enable execution with excess rights.

AC-2 Account Management
addresses: CWE-250

Reviewing accounts for compliance, disabling/removing unneeded accounts, and aligning with termination processes prevents execution with unnecessary privileges.

AC-5 Separation of Duties
addresses: CWE-250

Separation of duties prevents any single user from holding all privileges needed to complete a critical task, directly reducing execution with unnecessary privileges.

AC-6 Least Privilege
addresses: CWE-250

Directly prevents execution with more privileges than needed for assigned tasks.

AT-3 Role-based Training
addresses: CWE-250

Role-based training on least privilege principles reduces the chance personnel assign or retain unnecessary privileges.

AU-6 Audit Record Review, Analysis, and Reporting
addresses: CWE-250

Analysis of audit records can identify execution with unnecessary privileges through unusual activity patterns.

CA-9 Internal System Connections
addresses: CWE-250

Automatic termination after a defined period eliminates unnecessary privileges from persistent connections.

References