VulnSocial

CVE-2026-44015Disclosure(nginxui / nginx_ui)

LOWCVSS 9.9 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for nginxui nginx_ui systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwards these requests to the attacker-specified internal address, bypassing network segmentation and enabling access to services bound to localhost or internal networks.

nginxui CVEsBack to dashboard
3.5/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • nginx_ui

Threat summary

  • Active exploitation appears in 1 classified signals
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-05-12); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
nginxui
Products
nginx_ui

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-05-12: 2Mentions · 2026-05-13: 1Active Exploitation · 2026-05-12: 1Technical Details · 2026-05-12: 2Technical Details · 2026-05-13: 105-1205-13
Signal classification2 categories
Disclosure
266.7%
Active Exploitation
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-05-122
Active Exploitation1Disclosure1
2026-05-131
Disclosure1
Full discourse3 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-44015 Authenticated Server-Side Request Forgery in Nginx UI 2.3.4 and Earlier https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44015

    Post summary

    The post merely identifies CVE‑2026‑44015 as an authenticated SSRF bug affecting Nginx UI versions 2.3.4 and earlier, with no mention of PoC, exploit, active attacks, or patches.

    0000059
    4.0K followersView on X
  • Kaitan ID Security@KaitanSecurity
    Active Exploitation

    ⚠️ HIGH — CVE-2026-44015 Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Serv… CVSS 8.5 ⚡ Exploit in the wild Full analysis → https://sec.kaitan.id/cves/CVE-2026-44015 #Nginx #CyberSecurity #InfoSec

    Post summary

    The post announces CVE‑2026‑44015, highlights an 8.5 CVSS score and states there are active exploits in the wild, without providing patch details or a PoC.

    0000078
    90 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-44015 Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cl… https://www.cve.org/CVERecord?id=CVE-2026-44015

    Post summary

    The text announces that Nginx UI version 2.3.4 and earlier contains an SSRF vulnerability for authenticated users; it provides no PoC, exploit code, or remediation details.

    0000085
    57.5K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appnginxuinginx_ui---

Explore more

Back to dashboardnginxui CVEsnginx_ui vulnerabilities