Is CVE-2026-9772 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9772 being exploited in the wild.

How severe is CVE-2026-9772?

High severity, with a CVSS score of 8.8, published 24 June 2026.

Which products and versions are affected?

Unraid OS versions prior to 7.3.0 stable.

Is there a fix for CVE-2026-9772?

A patch was published on 2026-06-24: Fixed in version 7.3.0 stable Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9772 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-9772?

Check whether you run Unraid OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9772: Unraid OS command injection in FileUpload.php

CVE-2026-9772 · Severity: high · CVSS 8.8 · Published 2026-06-24

Unraid, a popular operating system for managing home servers and network-attached storage (NAS), contains a security flaw in its web-based management interface. An authorized user can exploit this weakness to run unauthorized commands on the server. This could lead to a total compromise of the system, allowing an attacker to access, modify, or delete stored data and disrupt server operations.

Vendors: Unraid.

Quick answers

Is CVE-2026-9772 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9772 being exploited in the wild.
How severe is CVE-2026-9772?: High severity, with a CVSS score of 8.8, published 24 June 2026.
Which products and versions are affected?: Unraid OS versions prior to 7.3.0 stable.
Is there a fix for CVE-2026-9772?: A patch was published on 2026-06-24: Fixed in version 7.3.0 stable Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9772 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-9772?: Check whether you run Unraid OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in the FileUpload.php component of the Unraid web server. The flaw stems from insufficient validation of user-supplied strings before they are passed to a system call. A remote attacker with low-privileged authentication can exploit this by sending a specially crafted request to the web interface. Successful exploitation allows for arbitrary code execution in the context of the www-data user. The issue is resolved in Unraid OS version 7.3.0 stable.

Affected products

Unraid Unraid OS versions prior to 7.3.0 stable

Timeline

2026-04-22: disclosed: Vulnerability reported to vendor
2026-06-24: advisory: Coordinated public release of advisory
2026-06-24: patched: Fixed in version 7.3.0 stable

References

https://www.zerodayinitiative.com/advisories/ZDI-26-385/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.