Roxy-WI EUVD-2026-36064

Exploitation requires only network reachability to the Roxy-WI web interface on a vulnerable instance (version 8.2.6.4 or earlier) and the ability to issue an HTTP request whose URL either contains the substring 'api' (triggering the authentication-bypass code path) or targets the /api/gpt endpoint (which is unauthenticated by design). No credentials, no user interaction, no specific non-default configuration, and no platform-specific prerequisites are needed. The practical limiting factor is exposure: instances reachable only from a trusted management VLAN or behind an authenticating reverse proxy are not exploitable by external attackers.

The CVSS vector AV:N/AC:L/PR:N/UI:N indicates fully remote, low-complexity, unauthenticated exploitation, which is the worst-case combination for an exposed management UI; scope is changed (S:C) reflecting that bypassing auth in the UI lets the attacker reach functionality belonging to a different security authority (the managed proxy/LB infrastructure). The C:L/I:L/A:L impact metrics moderate the headline score to 8.3 rather than 9.8, suggesting the bypass yields partial rather than full control of the host. No EPSS score, KEV listing, or SSVC decision was provided in the input, so probabilistic exploitation likelihood cannot be quantified, but the combination of trivial exploitability and absence of a patch makes this a real and urgent priority for any internet-facing deployment. No public exploit identified at time of analysis, however the description discloses the bypass technique itself, which materially lowers the barrier to weaponization.

An attacker who can reach a Roxy-WI instance over the network sends an unauthenticated HTTP request to /api/gpt (or another URL crafted to contain the 'api' substring) and obtains access to API functionality that should require an authenticated session, allowing interaction with the management plane of the underlying HAProxy/Nginx/Apache/Keepalived servers. Because the attack is network-based, low-complexity, and requires no privileges or user interaction, opportunistic mass scanning for Roxy-WI instances is plausible once the bypass URL pattern is widely known. No public exploit identified at time of analysis, but the advisory itself describes the bypass technique.