Is CVE-2026-9773 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9773 being exploited in the wild.

How severe is CVE-2026-9773?

High severity, with a CVSS score of 8.8, published 24 June 2026.

Which products and versions are affected?

Unraid OS Versions prior to 7.3.0 stable.

Is there a fix for CVE-2026-9773?

A patch was published on 2026-06-24: Fixed in version 7.3.0 stable Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9773 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-9773?

Check whether you run Unraid OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9773: Unraid Web Server command injection in ToggleState.php

CVE-2026-9773 · Severity: high · CVSS 8.8 · Published 2026-06-24

A security vulnerability exists in Unraid, a popular operating system for managing home servers and network-attached storage. An authorized user can exploit a flaw in the web management interface to run unauthorized commands on the server. This could allow an attacker to gain full control over the system, potentially leading to data theft, service disruption, or the installation of malicious software.

Vendors: Unraid.

Quick answers

Is CVE-2026-9773 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9773 being exploited in the wild.
How severe is CVE-2026-9773?: High severity, with a CVSS score of 8.8, published 24 June 2026.
Which products and versions are affected?: Unraid OS Versions prior to 7.3.0 stable.
Is there a fix for CVE-2026-9773?: A patch was published on 2026-06-24: Fixed in version 7.3.0 stable Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9773 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-9773?: Check whether you run Unraid OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in the Unraid web server within the ToggleState.php component. The flaw is caused by insufficient validation of user-supplied input before it is passed to a system call. A remote, authenticated attacker can exploit this by sending a specially crafted request to execute arbitrary OS commands with the privileges of the 'www-data' user. The vulnerability is addressed in Unraid OS version 7.3.0 stable.

Affected products

Unraid Unraid OS Versions prior to 7.3.0 stable

Timeline

2026-04-22: disclosed: Vulnerability reported to vendor
2026-06-24: advisory: Coordinated public release of advisory
2026-06-24: patched: Fixed in version 7.3.0 stable

References

https://www.zerodayinitiative.com/advisories/ZDI-26-386/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.