Exploited Nginx UI Vulnerability Enables Unauthenticated Server Takeover
Summary
CVE-2026-33032 in Nginx UI enables unauthenticated server takeover and was reported exploited in the wild. More than 2,600 exposed instances were found; the flaw is patched in version 2.3.4, but attack details are not public.
Key points
- CVE-2026-33032 affects Nginx UI’s recently added AI (MCP) integration.
- Pluto Security demonstrated that specially crafted requests let an unauthenticated attacker take over Nginx servers.
- Pluto Security reported finding more than 2,600 internet-exposed instances.
- Recorded Future reported that the vulnerability was among 31 high-impact flaws observed exploited in March 2026; details about these attacks are not public.
- Nginx UI patched the vulnerability in version 2.3.4; technical details and proof-of-concept exploit code are publicly available.
- Potential consequences such as traffic interception, backdoors, malicious redirects, disruption, and data theft are described as theoretical, not confirmed attack outcomes.
Article Details
- Vulnerability Types
- Unauthenticated server takeover
- Severity
- Critical
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
MITRE ATT&CK
CVE
CVE-2026-279440xJacky · nginx-uiUsers have also been warned about CVE-2026-27944, which can be exploited for unauthenticated backup data downloads, and CVE-2026-33030, which allows authenticated attackers to access, modify, and delete other users’CVE-2026-330300xJacky · nginx-uiwarned about CVE-2026-27944, which can be exploited for unauthenticated backup data downloads, and CVE-2026-33030, which allows authenticated attackers to access, modify, and delete other users’ resources.CVE-2026-330320xJacky · nginx-uiThe software is affected by a vulnerability tracked as CVE-2026-33032, which was patched recently in version 2.3.4.