What is the CVSS score of CVE-2026-15733?

CVE-2026-15733 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.5%.

Which versions of WGDashboard are affected by CVE-2026-15733?

WGDashboard versions up to 4.3.2, a self-hosted WireGuard management interface, contain a critical remote code execution vulnerability (CVE-2026-15733, CVSS 9.8) that allows attackers to execute…

Is there a public PoC exploit available for CVE-2026-15733?

Yes, a public proof-of-concept exploit is available for CVE-2026-15733. Prioritise patching immediately. EPSS: 1.5%.

How to fix or mitigate CVE-2026-15733?

Within 24 hours: immediately identify and inventory all WGDashboard instances in production and non-production environments, then isolate them from untrusted networks using firewall rules and network access controls. Within 7 days: evaluate alternative WireGuard management solutions and develop a migration timeline; if WGDashboard must remain in use, implement strict network segmentation (restrict access to internal networks only) and deploy a reverse proxy with authentication enforcement at the perimeter. Within 30 days: complete migration to an alternative solution or finalize a hardened configuration with comprehensive logging and real-time alerting on all administrative access attempts.

WGDashboard CVE-2026-15733

EUVD-2026-54247 CRITICAL

OS Command Injection (CWE-78)

2026-08-06 cret@cert.org

GHSA-wx9m-5w28-64m2

RCE Command Injection

9.8

CVSS 3.1 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable web UI with low complexity, but the description requires an authenticated attacker so PR:L rather than PR:N; command execution as root yields full C/I/A loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Threat Model Generated

Aug 31, 2026 - 11:40 vuln.today

Analysis Generated

Aug 07, 2026 - 20:30 vuln.today

CVSS changed

Aug 07, 2026 - 18:22 NVD

9.8 (CRITICAL)

CVE Published

Aug 06, 2026 - 22:16 cve.org

CRITICAL 9.8

CVE Published

Aug 06, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A Remote Code Execution (RCE) vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to execute arbitrary commands as root.

AnalysisAI

Remote code execution in WGDashboard (a self-hosted WireGuard management web UI) versions up to 4.3.2 lets attackers inject OS commands that execute as root through multiple unsanitized input paths (CWE-78). Publicly available exploit code exists (Stuub PoC targeting v4.3.2), and CISA's SSVC framework rates the technical impact as total and the flaw as automatable, though it is not listed in CISA KEV. Note a data conflict: the CVSS vector marks this as unauthenticated (PR:N) while the description states exploitation requires an authenticated attacker.

Technical ContextAI

WGDashboard is a Python/Flask-based web dashboard for administering WireGuard VPN peers and configurations, typically run as a privileged service so it can manipulate WireGuard interfaces and system network state. The root cause is CWE-78 (OS Command Injection): user-controlled input is passed into shell command execution without adequate sanitization or argument isolation, allowing shell metacharacters to break out and run attacker-chosen commands. Because the dashboard process runs as root to manage the VPN, injected commands inherit root privileges, turning a web-layer injection into full host compromise. The EUVD-listed affected range (0 ≤ 4.3.2) and the PoC repository name both indicate the vulnerable code persisted through v4.3.2, broader than the description's stated '4.2.3 and earlier.'

RemediationAI

No exact fixed version number is provided in the input, so treat this as 'Upstream fix available; released patched version not independently confirmed' - monitor the vendor repository at https://github.com/WGDashboard/WGDashboard for a release above 4.3.2 and upgrade to it as the primary remediation. Until a confirmed patched release is applied, remove the dashboard from any public network exposure: bind it to localhost or place it behind a VPN/reverse proxy with strong authentication and IP allow-listing (trade-off: remote admins must tunnel in). Reduce blast radius by running the WGDashboard service under a dedicated non-root account with only the specific sudo/capabilities needed to manage WireGuard rather than full root (trade-off: requires reconfiguring privilege delegation and may break interface management if scoped too tightly). Enforce strong, unique admin credentials and monitor the dashboard's request/command logs for shell metacharacters. Consult the NVD advisory (https://nvd.nist.gov/vuln/detail/CVE-2026-15733) and the PoC repository (https://github.com/Stuub/WGDashboard-v4.3.2-OS-Command-Injection-to-Root-RCE-PoC) to identify the exact injectable endpoints to restrict.