What is the CVSS score of EUVD-2026-36038?

EUVD-2026-36038 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Roxy-WI are affected by EUVD-2026-36038?

Roxy-WI versions 8.2.6.4 and earlier allow authenticated users to write arbitrary files to all managed load balancers in their group, enabling root-level code execution that could compromise…

How to fix or mitigate EUVD-2026-36038?

Within 24 hours: Inventory all Roxy-WI deployments and confirm version numbers; immediately revoke or rotate credentials for users with WAF rule management access. Within 7 days: Implement network-level access controls restricting access to the WAF rule save endpoint; enable detailed audit logging of file writes to system directories (/etc/cron.d/, /etc/cron.*); consider disabling Roxy-WI if business requirements permit. Within 30 days: Monitor vendor advisories for patch availability (subscribe to Roxy-WI security feeds); conduct forensic analysis of load balancer systems for unauthorized cron jobs or suspicious file modifications; develop upgrade plan for when patch becomes available.

Roxy-WI EUVD-2026-36038

| CVE-2026-45556 CRITICAL

Improper Input Validation (CWE-20)

2026-06-10 GitHub_M

Apache Information Disclosure Nginx Roxy Wi

9.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 15:15 vuln.today

CVE Published

Jun 10, 2026 - 14:00 nvd

CRITICAL 9.9

DescriptionNVD

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /waf/<service>/<server_ip>/rule/<rule_id>/save accepts a config_file_name form field that is passed straight through to config_mod.master_slave_upload_and_restart(...) as the destination path. The validation chain (_replace_config_path_to_correct → check_is_conf) only requires the path to contain a hard-coded service substring (nginx/haproxy/apache2/httpd/keepalived) and the substring conf or cfg, and to not contain ... The encoded-slash substitution 92 → / is applied before the substring check, so the attacker can build any absolute path anywhere on the LB filesystem as long as it satisfies those substring constraints. The body of the WAF rule (config form field) is written verbatim to that path. By choosing a filename like 92etc92cron.d92nginx_cfg_evil (resolving to /etc/cron.d/nginx_cfg_evil), an attacker drops a cron entry on the load balancer with attacker-controlled content. Cron parses the file on its next scan, executing the embedded job as root - full RCE on every load balancer the caller's group manages. At time of publication, there are no publicly available patches.

Articles & Coverage 4

News 9 New Nginx Vulnerabilities - 4 Critical, 5 High Severity Patched Jun 11, 2026 News 12 New Apache Vulnerabilities - 6 Critical, 6 High Severity Jun 11, 2026 News 11 New Apache Vulnerabilities - 4 Critical, 7 High Severity Jun 10, 2026 News Critical RCE in Roxy-WI Nginx Manager 8.2.6.4 - CVE-2026-45556 Jun 10, 2026

AnalysisAI

Remote code execution in Roxy-WI versions 8.2.6.4 and prior allows authenticated users to write attacker-controlled content to arbitrary absolute paths on managed load balancers via the WAF rule save endpoint. By dropping a malicious cron file (e.g., /etc/cron.d/nginx_cfg_evil), an attacker achieves root-level code execution on every load balancer in the caller's group. No public exploit identified at time of analysis, and no vendor-released patch is currently available, making this a high-priority issue for any exposed deployment.

Technical ContextAI

Roxy-WI is a web interface that centrally manages HAProxy, Nginx, Apache, and Keepalived load balancer servers (CPE: cpe:2.3:a:roxy-wi:roxy-wi). The vulnerability is a textbook CWE-20 Improper Input Validation flaw in the path-handling logic of the WAF rule save endpoint (POST /waf/<service>/<server_ip>/rule/<rule_id>/save). The validation helpers _replace_config_path_to_correct and check_is_conf only enforce that the destination path contains a hard-coded service substring (nginx, haproxy, apache2, httpd, or keepalived) plus 'conf' or 'cfg', and that it lacks '..' traversal sequences. Critically, the encoded-slash substitution (decoding '92' to '/') runs BEFORE the substring check, so any absolute path satisfying the trivial substring constraints can be reached. The config form field body is then written verbatim by config_mod.master_slave_upload_and_restart to the chosen destination on the managed load balancer.

RemediationAI

No vendor-released patch identified at time of analysis - the GHSA advisory (https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-85gm-773v-x7m4) states no public patches exist at publication, so monitor that advisory for an upstream fix and upgrade as soon as a patched release is announced. As compensating controls, restrict network access to the Roxy-WI web interface to a trusted admin VLAN or VPN to neutralize the AV:N exposure; tighten Roxy-WI group memberships and audit all low-privilege accounts since PR:L is the entry barrier; if WAF rule editing is not actively used, remove user permissions to the /waf/*/rule/*/save endpoint via a reverse-proxy ACL (trade-off: blocks legitimate WAF rule updates); on the managed load balancers, deploy file-integrity monitoring on /etc/cron.d, /etc/cron.hourly, and other cron drop-in directories to detect attacker-written files before the next cron scan executes them.