Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability. This issue is fixed in version 2.5.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
Critical flaw in Nginx UI (0xJacky): CVE-2026-107806, CVSS 9.4. Versions 2.3.8 up to 2.5.0 let an authenticated admin overwrite the config through the restore endpoint and run commands. VulnTracker recommends upgrading to Nginx UI 2.5.0 or later. Details: http://vulntracker.io/cves/CVE-2026-107806 #NginxUI #CVE #InfoSec
A critical Nginx UI RCE vulnerability (CVE-2026-107806) is publicly disclosed with PoC exploit code. Admins must patch now to prevent system takeover. #NginxUI #RCE #Vulnerability #CVE2026107806 #CyberSecurity https://securityonline.info/nginx-ui-rce-vulnerability/
🚨 CVE-2026-107806 | Critical RCE A critical authenticated Remote Code Execution vulnerability affects nginx-ui versions 2.3.8–2.4.x. Upgrade to 2.5.0 or later to mitigate the issue. 🔎 Technical details & PoC: https://pocbit.org/pocs/cve-2026-107806 #CyberSecurity #CVE #RCE #InfoSec #nginx
🚨 Nginx UI Authenticated RCE via Backup Restore (CVE-2026-107806) Critical Vulnerability Alert! 0xJacky Nginx UI (>= 2.3.8, < 2.5.0) is affected by CVE-2026-107806. 🔍 Identify Targets via ZoomEye: Search Dork: app="Nginx UI" Exposure: 10k instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJOZ2lueCBVSSI%3D #Infosec #CyberSecurity #ZoomEye
🚨Critical - Nginx UI Authenticated RCE via Restore Config Overwrite (CVE-2026-107806) Nginx UI’s backup restore flow lets an admin POST attacker-controlled key material + manifest to /api/restore to overwrite app.ini and protected nginx command settings (e.g., TestConfigCmd). Triggering /api/nginx/test then executes the injected command in the Nginx UI runtime context, leading to full RCE. 👉Affected: http://github.com/0xJacky/Nginx-UI