What is the CVSS score of CVE-2026-27811?

CVE-2026-27811 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache are affected by CVE-2026-27811?

Roxy-WI versions prior to 8.2.6.3 contain a critical command injection vulnerability allowing authenticated users to execute arbitrary commands on infrastructure management servers.

How to fix or mitigate CVE-2026-27811?

Within 24 hours: Inventory all Roxy-WI deployments and verify current versions; restrict access to the `/config/compare/` endpoint to essential personnel only; enable enhanced logging on affected systems. Within 7 days: Implement network segmentation to isolate Roxy-WI hosts from production infrastructure; deploy WAF rules to block malicious payloads targeting the vulnerable endpoint; conduct access reviews of all Roxy-WI user accounts. Within 30 days: Upgrade all instances to version 8.2.6.3 or later; perform security audit of Roxy-WI access logs for exploitation attempts; implement principle of least privilege for Roxy-WI service accounts.

Apache CVE-2026-27811

HIGH

Command Injection (CWE-77)

2026-03-18 security-advisories@github.com

Command Injection Apache Nginx

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 18, 2026 - 00:30 vuln.today

CVE Published

Mar 18, 2026 - 00:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.3, a command injection vulnerability exists in the /config/compare/<service>/<server_ip>/show endpoint, allowed authenticated users to execute arbitrary system commands on the app host. The vulnerability exists in app/modules/config/config.py on line 362, where user input is directly formatted in the template string that is eventually executed. Version 8.2.6.3 fixes the issue.

AnalysisAI

Roxy-WI versions prior to 8.2.6.3 contain a command injection vulnerability in the configuration comparison endpoint that allows authenticated users to execute arbitrary system commands on the host server. The flaw stems from unsanitized user input being directly embedded into template strings executed by the application. An attacker with valid credentials can exploit this to achieve full system compromise with high impact on confidentiality, integrity, and availability.

Technical ContextAI

This vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), a command injection flaw. The issue exists in app/modules/config/config.py at line 362 where user-supplied input is directly incorporated into a template string that is subsequently executed as a system command without proper sanitization or validation. Command injection occurs when an application passes unsafe user-supplied data to a system shell, allowing attackers to append malicious commands using shell metacharacters. Roxy-WI is a Python-based web application that provides centralized management for popular web servers and load balancers including Haproxy, Nginx, Apache, and Keepalived.

Affected ProductsAI

Roxy-WI web interface versions prior to 8.2.6.3 are affected by this command injection vulnerability. Roxy-WI is an open-source web management platform for Haproxy, Nginx, Apache and Keepalived servers developed by roxy-wi. The vulnerability was disclosed through GitHub Security Advisories (GHSA-jvmv-cw47-jh77) and confirmed by the project maintainers. The issue impacts all deployments running vulnerable versions regardless of which managed service (Haproxy, Nginx, Apache, or Keepalived) is being configured through the interface.

RemediationAI

Upgrade Roxy-WI to version 8.2.6.3 or later, which contains a fix for the command injection vulnerability as documented in the release notes at https://github.com/roxy-wi/roxy-wi/releases/tag/v8.2.6.3. The specific patch commit addressing this issue can be reviewed at https://github.com/roxy-wi/roxy-wi/commit/a10ac7306c252014f97a7213db4a9470300fa064. Until patching is complete, consider implementing compensating controls such as restricting network access to the Roxy-WI management interface to trusted IP ranges only, enforcing strong authentication policies, conducting audit log reviews for suspicious activity on the vulnerable endpoint, and applying principle of least privilege for user accounts. Full details are available in the GitHub Security Advisory at https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-jvmv-cw47-jh77.