ZDI 2026-06-24

ZDI-26-386: Unraid Web Server ToggleState Command Injection Remote Code Execution Vulnerability

CVE-2026-9773

Machine-generated analysis · WAYSCloud LLM

Authentication is required to exploit the command injection vulnerability in the Unraid Web Server's ToggleState function.

Context

The affected component is the Unraid Web Server, specifically a ToggleState command handling function. The vulnerability is a command injection issue that allows remote code execution. The advisory notes that authentication is required to exploit the vulnerability. Worth noting is that the CVSS score is rated 8.8, indicating high severity according to the ZDI.

Operator considerations

Check: Verify if Unraid systems are running the vulnerable version with the exposed Web Server component.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-9773.

Read the full advisory on ZDI →