EIP-2026-103286

This exploit leverages an authenticated admin user in ISPConfig 3 to modify a language file and inject arbitrary commands executed as root via a cron job. The attack involves adding a shell user with a specific GID and editing a configuration file to include malicious PHP code.