Loading story…
dCERT issued advisories for multiple vulnerabilities in nginx-ui, including flaws that can bypass security measures. The notices indicate that the affected software contains more than one weakness, with later reporting specifically highlighting the potential for attackers to circumvent intended protections.
The advisories identify nginx-ui as the impacted product and show an escalation from a general multi-vulnerability warning to a more specific assessment that security controls can be bypassed. Organizations using nginx-ui should review the relevant dCERT advisories, determine affected deployments, and prioritize remediation or compensating controls where immediate patching is not possible.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
dCERT published Advisory 2026-1255 covering multiple vulnerabilities in nginx-ui. This appears to be a new advisory update beyond the previously recorded nginx-ui disclosures.
dCERT published Advisory 2026-1217 for nginx-ui, stating that a vulnerability could allow information disclosure. This adds a new disclosed impact beyond the previously recorded nginx-ui advisories.
dCERT published Advisory 2026-1165 on nginx-ui, stating that multiple vulnerabilities could allow bypassing security measures. This represents a later escalation or refinement of the vulnerability reporting.
dCERT issued Advisory 2026-0907 covering multiple vulnerabilities in nginx-ui. This marks the initial disclosure reflected in the provided references.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
dcert.de
Open sourcedcert.de
Open sourcedcert.de
Open sourcedcert.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical authentication bypass in **nginx-ui** tracked as `CVE-2026-33032` is being actively exploited to seize control of internet-exposed Nginx servers. The flaw affects nginx-ui deployments with MCP support enabled because the `POST /mcp_message` endpoint enforced only IP whitelisting, while the default empty whitelist behaved as allow-all, leaving the endpoint reachable without authentication. Researchers said attackers can exploit the bug in seconds with minimal HTTP requests, then invoke MCP management functions to modify or delete Nginx configuration files, reload or restart services, redirect or intercept traffic, disrupt applications, and steal administrator credentials and other secrets. Pluto Security reported the issue in March, and multiple security outlets said threat actors began exploiting it in the wild after technical details emerged. The vulnerability carries a **CVSS 9.8** rating and impacts nginx-ui **2.3.5 and earlier**, with fixes released starting in version **2.3.4** and later secure releases also available. Public reporting estimated roughly **2,600 to 2,700** exposed nginx-ui instances online, and Recorded Future and VulnCheck both flagged the bug as under active exploitation. Administrators have been urged to upgrade immediately, disable or restrict MCP access if patching is delayed, populate the IP whitelist with trusted hosts, and review logs for suspicious configuration changes or unauthorized reload activity.
Jun 29, 2026
German government CERT advisories report multiple vulnerabilities in **NGINX** and **NGINX Plus** that can be exploited for **denial of service**, with a newer notice warning that affected **NGINX Open Source** and **NGINX Plus** deployments may also face **potential code execution**. The advisories indicate that the issues affect both the commercial and open source product lines, expanding the risk beyond service disruption alone. The earlier advisory described multiple flaws enabling service outages in NGINX and NGINX Plus, while the later advisory escalated the impact to include possible remote code execution in addition to denial of service. Organizations running internet-facing NGINX infrastructure should review the referenced dCERT notices, identify exposed versions across reverse proxies, load balancers, and web servers, and prioritize vendor-recommended updates or mitigations.
Jun 29, 2026
**Nginx UI** disclosed a critical vulnerability, **CVE-2026-27944** (CVSS **9.8**), that allows **unauthenticated** attackers to download and immediately decrypt full system backups from exposed management interfaces. The issue affects Nginx UI versions **prior to 2.3.2** and is addressed by upgrading to **2.3.3+**. The root cause is a combination of missing authentication on the `/api/backup` endpoint (CWE-306) and improper handling of cryptographic material (CWE-311), enabling direct access to backup archives. Exploitation is straightforward: an attacker can send a GET request to `/api/backup` to retrieve an encrypted ZIP backup, while the server simultaneously leaks the **Base64-encoded AES-256 key and IV** in the `X-Backup-Security` HTTP response header, allowing immediate decryption. Reported exposed contents include `database.db` (user credentials), `app.ini` configuration, **SSL certificates and private keys**, Nginx configuration and virtual host data, and potentially **session tokens**, creating follow-on risk for console takeover, man-in-the-middle enablement, and broader network pivoting. A public **PoC** is available, increasing the likelihood of opportunistic exploitation; the primary mitigation is to **upgrade to Nginx UI 2.3.3 or later** and ensure the management interface is not publicly reachable.
Jun 29, 2026