CVE-2026-92761

WebVirtCloud, a web panel for managing KVM virtual machines, fails to validate the permission flags attached to UserInstance grants, checking only that a grant exists via its get_instance gate. As a result, any user holding even a view-only grant can invoke privileged instance actions remotely, including powering off virtual machines, resetting root passwords, installing SSH keys, and managing ISO images. Resetting a VM's root password and injecting an SSH key effectively hands the attacker full control of the guest system, and the attack requires only valid low-privilege credentials with no user interaction. Any WebVirtCloud operator that has granted instance access to untrusted or shared users is affected. No exploitation in the wild or public proof-of-concept is currently known, and the issue is not listed in CISA's KEV catalog.

What to do: Update WebVirtCloud to the latest available release once a patched version is published, since the data does not yet identify a fixed version. In the interim, audit all UserInstance grants and revoke or restrict view-only grants for untrusted users, and monitor instance action logs for unauthorized power-offs, root password resets, SSH key additions, or ISO changes. Apply the CVSS low-privilege caveat: only operators who share panel accounts with third parties are meaningfully exposed.