Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-33026

32
FAUCET Score

CVE-2026-33026 impacts Nginx UI versions prior to 2.3.4, where a flaw in the backup restore mechanism allows authenticated attackers to tamper with encrypted backup archives and inject malicious configurations during restoration. This is a critical vulnerability (CVSS 9.1) that is remotely exploitable with low attack complexity, requiring high privileges but no user interaction, and can lead to complete compromise of confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, public exploit code availability (Metasploit, Nuclei, ExploitDB), or significant community discussion regarding this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
< 2.3.4CPE matchmatch criteria
cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 4.0

9.4CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
HIGH
User Interaction
NONE
VS Confidentiality
HIGH
VS Integrity
HIGH
VS Availability
HIGH
SS Confidentiality
HIGH
SS Integrity
HIGH
SS Availability
HIGH
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.33%
Probability of exploitation in next 30 days
EPSS Percentile
25.2%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.0033 is in the 6th percentile among its peer group of 462 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.7 Bluesky, 0.4 Mastodon, and 1.7 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.4 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

gopatch availablevia ghsa
Product: github.com/0xJacky/Nginx-UIFixed in: 1.9.10-0.20260315015203-f61bcec547c0
github_advisoryworkaround availablevia nvd_reference
View patch

Vendor Advisories (1)

goGHSA-fhh2-gg7w-gwpqcritical

nginx-ui Backup Restore Allows Tampering with Encrypted Backups

Mar 30, 2026

References

github.com / 0xJacky/nginx-ui/releases/tag/v2.3.4
ProductRelease Notes
github.com / 0xJacky/nginx-ui/security/advisories/GHSA-fhh2-gg7w-gwpq
ExploitMitigationVendor Advisory