Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a 'sudo -S sh' child process. When sudo does not prompt for a password (the process runs as root, NOPASSWD is configured, or a recent sudo timestamp cache exists), the sudoPassword value is interpreted by sh as a shell command, allowing a remote unauthenticated attacker to execute arbitrary OS commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-04 (UTC).
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-07 | 1 | Patch1 |
| 2026-07-12 | 1 | Active Exploitation1 |
認証不要でコマンド実行が可能 — 9Router(CVE-2026-59800, CVSS9.8)はShadowserverが実際の攻撃を確認。PleskにもCVSS9.9の重大情報漏洩が公開。
Post summary
The post confirms CVE-2026-59800 is being exploited in the wild, enabling unauthenticated command execution on 9Router, and also highlights a severe Plesk information‑leak vulnerability.
🚨 CVE-2026-59800 — CVSS 9.8/10 ██████████ 9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/2XS6laqaCt
Post summary
The tweet discloses a critical OS command injection (CVE‑2026‑59800) in 9Router versions before 0.4.44, highlights its high CVSS score, and urges users to apply the available patch.