nginx-ui Critical Remote Code Execution Vulnerabilities

CERT-Bund published a critical security advisory (WID-SEC-2026-0931) documenting multiple remote code execution vulnerabilities in nginx-ui prior to version 2.3.4. The vulnerabilities carry a CVSS Base Score of 9.8 (critical) and a Temporal Score of 8.8 (high). Affected organizations are warned that remote, authenticated attackers can exploit these flaws to obtain administrator access, execute arbitrary code, manipulate data, circumvent security mechanisms, or trigger denial-of-service conditions.

Organizations running nginx-ui installations must update to version 2.3.4 or later as soon as possible. Security teams should review systems for signs of compromise, apply available mitigations, and assess whether nginx-ui deployments handle sensitive data or are exposed to untrusted network access. Given the critical severity and remote attack vector, patching takes priority over routine change management processes.