CVE-2026-59800 decolua CVE debrief

Who should care

Users of 9Router before version 0.4.44 should apply the patch to prevent exploitation of this vulnerability. Additionally, administrators and security teams responsible for managing and securing 9Router deployments should review the vulnerability details and take necessary actions to mitigate the risk. This includes restricting access to the /api/tunnel/tailscale-install endpoint and monitoring for suspicious activity.

Technical summary

CVE-2026-59800 is an OS command injection vulnerability in 9Router before 0.4.44. The vulnerability exists in the unauthenticated POST /api/tunnel/tailscale-install endpoint. The sudoPassword field from the request body is written to the stdin of a 'sudo -S sh' child process. When sudo does not prompt for a password, the sudoPassword value is interpreted by sh as a shell command, allowing a remote unauthenticated attacker to execute arbitrary OS commands. The vulnerability has a CVSS score of 9.2 and a severity of CRITICAL.

Defensive priority

High

Recommended defensive actions

• Apply the patch to upgrade 9Router to version 0.4.44 or later
• Restrict access to the /api/tunnel/tailscale-install endpoint
• Monitor for suspicious activity on the /api/tunnel/tailscale-install endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-04 (UTC). The evidence suggests that the vulnerability is being actively exploited in the wild. However, due to the limited information available, further verification is required to confirm the extent of the exploitation and the potential impact on affected systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.