Webmin and Virtualmin: updates and safe exposure

Updated November 2026

Webmin runs as root and listens on port 10000, so an old copy reachable from the internet is a direct path to the whole server. Install it from the official package repository so normal system updates keep it current, check that you are on the latest release (Webmin 2.670 and Virtualmin 8.3.0 as of November 2026), and limit port 10000 to your own addresses, a VPN or an SSH tunnel.

What Webmin and Virtualmin are

Webmin is a free, open-source web interface for administering Unix and Linux systems: users, packages, services, firewall, cron and much more. Usermin is its companion for ordinary users (mail, files, passwords). Virtualmin is a hosting control panel built as a Webmin module (virtual-server) that creates websites, mailboxes and databases; it comes as a free GPL edition and a paid Pro edition. All three are maintained by the same team and share a web server, miniserv.

Many Webmin flaws need a logged-in user, but on a hosting server domain owners are logged-in users. Several 2026 fixes were privilege escalations from limited Webmin users to root, which matters for every Virtualmin server.

Check your version

webmin --version                       # installed Webmin version
webmin --versions                      # Webmin, Usermin, modules and themes
sudo virtualmin info host              # includes "virtualmin version:"
dpkg-query -W webmin usermin webmin-virtual-server 2>/dev/null   # Debian, Ubuntu
rpm -q webmin usermin wbm-virtual-server                         # RHEL family

The Virtualmin module is packaged as webmin-virtual-server on Debian and Ubuntu and as wbm-virtual-server on Enterprise Linux. The Webmin dashboard also shows the version after you log in.

Supported versions

Webmin and Virtualmin have no long-term branches or end-of-life dates. Security fixes appear in the next release, and older releases are not patched. In practice, “supported” means the latest release. As of November 2026:

Virtualmin lists its fully supported (“Grade A”) systems as RHEL, AlmaLinux and Rocky Linux 8, 9 and 10; Debian 12 and 13; and Ubuntu 24.04 and 26.04 LTS. Webmin itself runs on many more systems, but the update instructions below cover the packaged installs.

Distribution packages vs the project repository

Major distributions do not ship current Webmin packages, so almost every install uses the project’s own repository. Webmin’s setup script adds the repository and its signing key:

curl -o webmin-setup-repo.sh https://raw.githubusercontent.com/webmin/webmin/master/webmin-setup-repo.sh
sudo sh webmin-setup-repo.sh

Virtualmin systems use the Virtualmin repository instead (download.virtualmin.com), which also provides Webmin. If packages stop updating, re-create the Virtualmin repository configuration on the stable branch:

sudo virtualmin configure-repos        # on an installed Virtualmin system
# or, if the virtualmin command is not available:
curl -fsSL https://download.virtualmin.com/repository | sudo sh -s -- -s -B stable

The prerelease and unstable branches are for testing, not production. Webmin can only be upgraded with the same kind of package it was installed from; if yours came from a .tar.gz, switching to the repository is worth the effort.

Update Webmin and Virtualmin

# Debian, Ubuntu: just Webmin, Usermin and Virtualmin
sudo apt-get update
sudo apt-get install --only-upgrade webmin usermin webmin-virtual-server

# Debian, Ubuntu: everything, including Virtualmin's stack
sudo apt-get update && sudo apt-get upgrade

# RHEL, AlmaLinux, Rocky
sudo dnf upgrade webmin usermin wbm-virtual-server     # just these
sudo dnf upgrade                                       # everything

Leave out any package you do not have installed. The package scripts restart Webmin (this restarts only the panel, not hosted sites). In Virtualmin, the dashboard also shows a notice when Virtualmin-related package updates are available, with an “Install All Updates Now” button. Afterwards, check with webmin --version, and if something looks wrong, sudo webmin server status.

Automatic updates

Because Webmin is an ordinary package, the distribution’s automatic update tools can keep it current, but the default settings may skip third-party repositories:

• Debian and Ubuntu: unattended-upgrades installs only security updates from the distribution by default. Run apt-cache policy webmin to see the repository’s origin, and add it to Unattended-Upgrade::Origins-Pattern if you want Webmin updated automatically.
• RHEL family: dnf-automatic applies to all enabled repositories unless you limit it to security updates. Third-party packages like Webmin usually carry no security metadata, so a security-only setting skips them.

Details for both tools are in Automatic updates. Whatever you choose, operating system updates (kernel, OpenSSL, OpenSSH) still have to run, and a kernel update still needs a reboot; see Kernel updates.

Recent security fixes

For the SSRF issue, Webmin also suggests limiting which URLs restricted users may download from, under Webmin Users » Permissions for all modules » URL download destinations. Other server software is covered on the vulnerability list.

Keep port 10000 off the internet

By default Webmin listens on port 10000 on every IP address and accepts connections from anywhere. Pick one of these, from most to least restrictive:

1. Bind to localhost and use an SSH tunnel. In Webmin Configuration » Ports and Addresses, set “Listen on IP address” to 127.0.0.1. Then connect from your computer and open https://localhost:10000/:

   ssh -L 10000:127.0.0.1:10000 admin@server.example.com

   This also hides Virtualmin from domain owners, so it suits servers where only admins log in.
2. Allow only listed addresses. In Webmin Configuration » IP Access Control, choose to allow only listed addresses and enter your office IPs, VPN range or CIDR blocks.
3. Firewall the port. Allow TCP 10000 only from admin addresses or the VPN, as in the firewall guide. Do this even if you also use IP Access Control.

Also keep SSL mode on (Webmin Configuration » SSL Encryption) and leave failed-login blocking enabled (Webmin Configuration » Authentication, “Block hosts with more than … failed logins”). Changing the port from 10000 to another number reduces log noise but is not a security control on its own.

Turn on two-factor authentication

In Webmin Configuration » Two-Factor Authentication, choose a provider (Google Authenticator uses standard TOTP and is checked by Webmin itself; Authy is the other option) and save. Then each user enrolls in Webmin Users » Two-Factor Authentication and scans the QR code. From then on, login asks for a 6 or 7 digit code. If an admin loses the device, root can remove the second factor from the shell:

sudo webmin disable-twofactor --user USERNAME

Where advisories are published

• The Webmin security page, which lists issues by “Webmin prior to” version. New issues are reported to security@webmin.com.
• The Webmin changelog, which also announces Usermin and Virtualmin releases.
• Your general advisory sources, see Security advisories.

Quick hardening tips

• Install from the Webmin or Virtualmin repository so updates arrive with the rest of the system.
• Never leave port 10000 open to the whole internet; use a tunnel, VPN or IP allowlist.
• Turn on 2FA for root and every admin account.
• Give limited Webmin users only the modules they need, and avoid Custom Commands with parameters for untrusted users.
• Remove Webmin from servers where nobody uses it.
• Do not read mail from untrusted senders in Webmin’s Read User Mail module while logged in as root.
• Check the security page after every release and compare with webmin --version.

Sources

• Webmin security, Webmin project
• Changelog, Webmin project
• Download, Webmin project
• Webmin Configuration module, Webmin documentation
• Webmin CLI, Webmin documentation
• FAQ, Virtualmin documentation
• OS support, Virtualmin documentation
• Troubleshooting repositories, Virtualmin documentation
• info (CLI), Virtualmin documentation