A critical 9.8 CVSS flaw (CVE-2026-27944) in Nginx UI lets hackers download and decrypt ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CVE-2026-27944 Exposes Sensitive Data via Unauthenticated API Access CVE-2026-27944 was published on March 5, 2026, revealing that the /api/backup endpoint is accessible without authentication, allowing unauthenticated attackers to download sensitive system backups. These backups can contain user credentials, session tokens, SSL private keys, and Nginx configurations, which can be decrypted using disclosed encryption keys in the response header. 11 sources 69