Is CVE-2026-45552 actively exploited?

No active exploitation of CVE-2026-45552 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-45552 be exploited remotely?

Yes. CVE-2026-45552 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-45552?

CVE-2026-45552 has a CVSS score of 9.9 (CRITICAL).

HOME VULNERABILITIESCVE-2026-45552

CRITICAL

CVE-2026-45552

CWE-639Published: June 10, 2026· Updated: Jun 17, 2026

9.9

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:12.1th

Official Description

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the install blueprint declares only bp.before_request → @jwt_required() (app/routes/install/routes.py:36-39). The individual endpoints install_exporter, install_waf, install_geoip, check_geoip, get_exporter_version, and get_task_status are not wrapped in page_for_admin and do not call roxywi_common.is_user_has_access_to_its_group(server_ip) or check_is_server_in_group(server_ip). Only the GET index page (install_monitoring) gates on roxywi_auth.page_for_admin(level=2). Because the missing decorators omit both role and group checks, any logged-in user — including the default guest role 4 — can install/reconfigure exporters, WAF, and GeoIP databases on every server in the Roxy-WI database, regardless of tenant ownership. The Ansible playbooks run with the per-server SSH credential stored in Roxy-WI, which the credentials' rightful owner (a different tenant) has provisioned with sudo rights for the management workflow. At time of publication, there are no publicly available patches.

NVD Source

Risk Analysis

This critical vulnerability in Roxy-WI allows any logged-in user, including those with guest privileges, to install or reconfigure various components like exporters, WAF, and GeoIP databases on all managed servers. This bypasses intended role and group access controls. With a CVSS score of 9.9, this flaw presents a severe risk of unauthorized system modification.

No public exploit is currently known for this vulnerability. Its remote exploitability and low attack complexity mean it could be exploited by any authenticated user.

Recommended Action

Administrators should update Roxy-WI to a version beyond 8.2.6.4 to resolve this critical authorization bypass. Ensure that all sensitive configuration endpoints are properly protected by robust access control mechanisms.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-45552 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.9.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.