What is the CVSS score of CVE-2026-9773?

CVE-2026-9773 has a CVSS 3.0 base score of 8.8 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.1%.

Which versions of Unraid are affected by CVE-2026-9773?

Unraid NAS management servers contain an authenticated command injection vulnerability (CVE-2026-9773, CVSS 8.8) allowing low-privilege web users to execute arbitrary system commands on the…

How to fix or mitigate CVE-2026-9773?

Within 24 hours: Inventory all Unraid systems and document versions; immediately restrict web management interface access to static IP allowlists and disable all remote access if not operationally required. Within 7 days: Implement network segmentation to isolate NAS management traffic from general networks; enable detailed audit logging for ToggleState.php requests and all web interface authentication attempts. Within 30 days: Establish direct contact with Unraid for patch availability timeline; if no patch released, evaluate deploying Unraid management functions to air-gapped systems or prepare full-system isolation protocols.

Unraid CVE-2026-9773

EUVD-2026-39109 HIGH

OS Command Injection (CWE-78)

2026-06-24 zdi

GHSA-59jp-p2r5-hfpj

Command Injection RCE PHP Unraid

8.8

CVSS 3.0 · Vendor: zdi

Severity by source

Vendor (zdi) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable endpoint with low-complexity injection requires a valid low-privilege web login (PR:L); command execution as www-data yields high C/I/A on an unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 22:23 vuln.today

DescriptionCVE.org

Unraid Web Server ToggleState Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability.

The specific flaw exists within ToggleState.php. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the www-data user. Was ZDI-CAN-30134.

Articles & Coverage 1

News 8 New PHP Vulnerabilities - 1 Critical, 7 High, 2 With POC Jun 25, 2026

AnalysisAI

Remote authenticated command injection in Unraid's web management server allows attackers to execute arbitrary OS commands as the www-data user by abusing unsanitized input in ToggleState.php. Any user with low-privilege authenticated web access can chain this CWE-78 flaw into full code execution on the underlying NAS host. Discovered and reported through ZDI (ZDI-CAN-30134 / ZDI-26-386); no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

Unraid is a Linux-based network-attached storage and virtualization operating system administered through a PHP-driven web GUI. The vulnerability is a classic OS command injection (CWE-78): the ToggleState.php endpoint takes a user-supplied string and passes it into a system shell call without proper validation or escaping, so attacker-controlled metacharacters break out of the intended command context. Because the web server's PHP processes run as the www-data account, injected commands inherit that account's privileges and access to Unraid management functions. The affected CPE is cpe:2.3:a:unraid:unraid (all versions per the available data, with no fixed version delimited).

RemediationAI

No vendor-released patch identified at time of analysis; the only published reference is the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-386/, which should be monitored for the fixed Unraid version, and administrators should update to a patched release as soon as Lime Technology issues one. As compensating controls, remove the Unraid web management interface from direct internet exposure and restrict it to a trusted management VLAN or VPN (trade-off: remote admins must connect via VPN); enforce strong, unique credentials and enable any available two-factor/SSL options to raise the bar on the required authentication, since the flaw is only reachable post-login; and place the web UI behind a reverse proxy or firewall ACL limiting source IPs to known administrator hosts (trade-off: added operational complexity and possible disruption to automation that calls the UI). Because exploitation runs as www-data, also review and minimize what that account can reach until a patch is applied.