VulnSocial

CVE-2026-93964Disclosure

LOWCVSS 5.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability was detected in NginxProxyManager nginx-proxy-manager up to 2.15.1. This impacts the function internalCertificate.validate of the file backend/internal/certificate.js of the component Validate Route. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be used. Endpoint only processes and echoes back the certificate the caller submits (no stored data leaked); the real risk is unauthenticated openssl processing of attacker input. The project was informed of the problem early through an issue report but has not responded yet.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-287CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-20); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-20: 1Mentions · 2026-10-30: 1Patch / Workaround · 2026-10-30: 1Technical Details · 2026-09-20: 1Technical Details · 2026-10-30: 109-2010-30
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-201
Disclosure1
2026-10-301
Patch1
Full discourse2 posts
  • NewNormal Security@NewScanTeam
    Disclosure

    NewNormal Security turns CVEs since the previous batch into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 20 Sep 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 📦 Missing authorization in a WordPress gallery plugin — any logged-in user reads image records they were never granted, including client proofing sets (NextGEN Gallery CVE-2026-81652, CVE-2026-81654) 📦 PHP object injection over XML-RPC — attacker-chosen classes instantiated inside the site (Forminator CVE-2026-87067) 🔎 Reverse-proxy admin panel now fingerprinted with its release — the box fronting a self-hosted estate appears in the inventory, so advisories against it can be matched (nginx-proxy-manager CVE-2026-93964) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #BrokenAccessControl #CSO #REDTEAM

    Post summary

    The tweet announces new detections for four recent CVEs, describing vulnerabilities such as missing authorization, PHP object injection, and reverse‑proxy fingerprinting, but provides no PoC, exploit, patch, or evidence of active exploitation.

    0100055
    7 followersView on X
  • Hugo | DevOps | Cybersecurity@HugoValters
    Patch

    CVE-2026-93964 Missing auth in NginxProxyManager up to 2.15.1, CVSS 5.3, public exploit, no patch. Unauthenticated openssl processing on the validate endpoint. Update immediately. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-93964 #NginxProxyManager #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The tweet discloses a missing authentication vulnerability (CVE‑2026‑93964) in NginxProxyManager up to version 2.15.1 (CVSS 5.3) with a public exploit available, no patch yet, and urges immediate updating.

    0000058
    1.1K followersView on X

Explore more

Back to dashboard