← Vulnerability feed

Vulnerability record · CVE-2023-35885 · published 20 June 2023

CVE-2023-35885: CloudPanel file-manager cookie authentication bypass

Mgt Commerce · Cloudpanel

CloudPanel 2 before 2.3.1 relies on file-manager cookies without validating them, so authentication can be bypassed. The flaw is remotely reachable with no credentials or user interaction, and public exploit code exists, making it a serious risk for exposed CloudPanel instances.

9.8 CVSS 3.1 Critical EPSS 75% · top 0.5% CWE-565 · Reliance on cookies without validation
9.8CVSS 3.1 base score
75%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable authentication bypass with public exploit code and very high EPSS probability.

What it is

CloudPanel 2 before 2.3.1 relies on file-manager cookies without validating them, so authentication can be bypassed. The flaw is remotely reachable with no credentials or user interaction, and public exploit code exists, making it a serious risk for exposed CloudPanel instances.

Impact

An unauthenticated attacker can reach the file manager and gain high confidentiality, integrity and availability impact, effectively taking control of files and the hosting environment.

Attack surface

Reachable over the network via the CloudPanel web interface; the CVSS vector shows no privileges required and no user interaction. No pre-existing session or valid credentials are needed.

Exploitation

Not listed in CISA KEV, but EPSS is 0.74888 (99.5th percentile) and multiple references are tagged Exploit, indicating public exploit code is available.

What to do

  • Upgrade CloudPanel to 2.3.1 or later immediately.
  • Restrict access to the CloudPanel management interface to trusted IPs or a VPN.
  • Rotate any credentials, API keys or secrets stored on affected hosts.
  • Review file-manager and admin logs for unauthorized access before patching.
  • Monitor vendor changelog and advisories for follow-up fixes.

Detection

  • Alert on file-manager requests lacking a validated session or with anomalous cookie values.
  • Monitor for unexpected file writes, uploads or permission changes in CloudPanel-managed directories.
  • Baseline and alert on new or unusual source IPs reaching the CloudPanel admin interface.
  • Correlate CloudPanel access logs with process execution on the host for post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/datackmy/FallingSkies-CVE-2023-35885 Exploit
https://www.cloudpanel.io/docs/v2/changelog/ Release Notes
https://www.datack.my/fallingskies-cloudpanel-0-day/ Exploit
https://github.com/datackmy/FallingSkies-CVE-2023-35885 Exploit
https://www.cloudpanel.io/docs/v2/changelog/ Release Notes
https://www.datack.my/fallingskies-cloudpanel-0-day/ Exploit

Track CVE-2023-35885 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2024-24320Mgt-commerce cloudpanel path traversal vulnerabilityDirectory Traversal vulnerability in Mgt-commerce CloudPanel v.2.0.0 thru v.2.4.0 allows a remote attacker to obtain sensitive information and execut…EPSS 4.0%8.8CVE-2023-46157Mgt-commerce cloudpanel os command injection vulnerabilityFile-Manager in MGT CloudPanel 2.0.0 through 2.3.2 allows the lowest privilege user to achieve OS command injection by changing file ownership and ch…EPSS 2.3%8.8CVE-2023-36630Mgt-commerce cloudpanel unrestricted file upload vulnerabilityIn CloudPanel before 2.3.1, insecure file upload leads to privilege escalation and authentication bypass.EPSS 0.87%8.1CVE-2023-0391Mgt-commerce cloudpanel hard-coded credentials vulnerabilityMGT-COMMERCE CloudPanel ships with a static SSL certificate to encrypt communications to the administrative interface, shared across every installati…EPSS 0.60%7.8CVE-2023-33747Mgt-commerce cloudpanel path traversal vulnerabilityCloudPanel v2.2.2 allows attackers to execute a path traversal.EPSS 0.47%7.8CVE-2026-0257PAN-OS GlobalProtect authentication bypass via unvalidated cookiesPAN-OS GlobalProtect portal and gateway contain authentication bypass flaws that let an attacker skip security restrictions and establish an unauthor…KEVEPSS 96%analysed

Source: NIST National Vulnerability Database (record CVE-2023-35885), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.