CVE-2026-9773: Unraid Command Injection RCE Vulnerability (CVSS 8.8)

Technical summary

CVE-2026-9773 is a command injection flaw in Unraid's ToggleState.php file. The vulnerability stems from insufficient validation of user-supplied input before it is passed to a system call. An authenticated attacker can inject shell metacharacters or commands into the vulnerable parameter, resulting in arbitrary code execution. The attack requires valid authentication credentials but no user interaction. The flaw maps to CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Business impact

Organizations running Unraid for storage, backup, or virtualization workloads face risk of unauthorized access, data exfiltration, and service disruption. Because the vulnerability requires authentication, the risk is elevated within organizations where Unraid access is granted to contractors, developers, or less-trusted staff. Compromise could lead to lateral movement into the broader network if the Unraid server holds sensitive data or maintains trust relationships with other systems. The www-data execution context may limit direct privilege escalation, but it often permits read/write access to hosted data and configuration files.

Affected systems

Unraid installations exposed to the internet or accessible to untrusted authenticated users are at immediate risk. Affected systems are running Unraid versions prior to the patched release. Organizations should verify their Unraid version against the official vendor advisory to confirm whether they are running a vulnerable release.

Exploitability

Exploitation requires valid authentication credentials, which moderates opportunistic attacks from the public internet. However, insider threats, compromised or shared user accounts, and pre-authenticated access via password reuse elevate practical risk. The attack is straightforward once authenticated: a single HTTP request with injected commands can execute code. No user interaction, exotic configurations, or race conditions are required. Exploit difficulty is low for attackers with valid access.

Remediation

Apply the security patch released by Unraid for this vulnerability as soon as feasible. Verify the patched version against the official Unraid security advisories. In the interim, restrict Unraid web console access to trusted networks or IP ranges using firewall rules or reverse proxy authentication. Review user access logs for suspicious API or web requests. Audit which user accounts have Unraid authentication privileges and revoke unnecessary access. Monitor for any unusual process execution under the www-data user on Unraid systems.

Patch guidance

Unraid has released a security update addressing CVE-2026-9773. Consult the official Unraid security advisory to identify the patched version. Apply updates during a maintenance window, as patching may require a service restart. After patching, verify that the ToggleState.php file has been updated and that input validation is now in place. Test non-critical systems first before deploying to production environments.

Detection guidance

Monitor web server logs (typically /var/log/nginx or Apache logs on Unraid) for POST or GET requests to ToggleState.php that contain shell metacharacters (backticks, $(), |, &, ;, etc.) in the request parameters. Watch for unexpected child processes spawned by the www-data user, especially shell or command interpreters. Network intrusion detection systems can be tuned to flag suspicious HTTP payloads targeting Unraid endpoints. Alert on authentication logs followed by unusual system command execution in syslog or auditd logs.

Why prioritize this

Although KEV status is not yet assigned, the CVSS 8.8 HIGH score and the availability of authenticated code execution make this a priority remediation. The authentication requirement reduces blast radius compared to unauthenticated flaws, but the high impact (confidentiality, integrity, availability all compromised) and ease of exploitation for authenticated users warrant urgent patching. Organizations with public-facing or multi-tenant Unraid deployments should prioritize this within their patch cycle.

Risk score, explained

The CVSS 3.0 score of 8.8 reflects high severity due to complete compromise of confidentiality, integrity, and availability (CCC:H/I:H/A:H), network accessibility, and low attack complexity. The score is appropriately reduced from critical (9.0+) by the requirement for prior authentication (PR:L), which limits opportunistic exploitation. In environments where Unraid is tightly access-controlled, practical risk may be lower; in environments with overly permissive authentication or shared credentials, risk approaches critical.

Frequently asked questions