SURIQ
If you run an Unraid box, the most important security control on it is no longer the login screen. On June 24, 2026, Trend Micro's Zero Day Initiative published two advisories for the Unraid web management panel, and both end the same way: any account that can log in can run operating-system commands on the server. Update to Unraid 7.3.0, and if that panel is reachable from the internet, treat that as the more urgent half of the job.
What was disclosed
The two bugs sit in different parts of the same web server. CVE-2026-9773 lives in ToggleState.php; its sibling CVE-2026-9772 lives in FileUpload.php. Each is an OS command injection: the code takes a value the user controls and hands it to a system call without scrubbing it first, so a crafted value is executed as a shell command instead of being treated as data. Both earned a CVSS score of 8.8, and both run the attacker's commands as www-data, the account the web interface itself runs under.
The Zero Day Initiative is also the CVE Numbering Authority here, and the cve.org record classifies the ToggleState flaw as CWE-78, OS command injection. Unraid was notified on April 22 and shipped the fix in version 7.3.0, whose release notes describe broader hardening of how the web interface handles authenticated requests. The advisories went public on June 24.
"Authentication required" is doing less work than it sounds
Both advisories list authentication as a precondition, and that does take these out of internet-scanner-finds-you territory. It does not make them low risk. Unraid is a single-administrator appliance: the web panel is the entire management surface for storage arrays, Docker containers, and virtual machines, and a working login is often one shared password away. Many owners expose that panel directly to the internet, or put it behind a thin reverse proxy, precisely because it is how they manage the box remotely. In that setup the login page is the only thing standing between a reused or phished credential and a shell on the host.
There is a second, quieter risk. A command injection that needs a valid session is exactly the kind of bug that pairs with an authentication-bypass flaw to become a full unauthenticated chain. Unraid has had auth-bypass issues before. Treat an authenticated RCE not as a contained problem but as the back half of an exploit chain someone may complete later.
The pattern is worth more than either bug
Two separate command-injection sinks in one web application, disclosed on the same day, is not a coincidence of bad luck. It points at a class of input handling where user-supplied values reach shell calls without a consistent validation layer in between. Fixing the two reported entry points is necessary; assuming they were the only two would be the mistake. This is the same shape of problem that keeps showing up in self-hosted management software, from services that ship unlocked by default to exposed device management interfaces: the admin plane is powerful, it runs with real privilege, and one missed sanitization turns a feature into a foothold.
Update to 7.3.0, then get the panel off the internet
The fix order matters here.
- Update to Unraid 7.3.0 (or later). This is the only step that actually closes both bugs. If you cannot update immediately, shrink who can reach the panel.
- Take the web GUI off the public internet. Reach it over a VPN, a private tunnel, or Unraid's own remote-access option instead of a forwarded port. This blunts both the credential-theft path and any future auth-bypass chain.
- Use a strong, unique administrator password. Because the precondition is a valid login, password reuse is the realistic way in. Rotate it if it has ever been shared or reused.
On the detection side, the useful signal is process lineage. Command execution as www-data means the web server's PHP worker spawning a shell or a network tool it has no business launching. Watch for child processes of the web stack that are not part of normal operation, unexpected outbound connections from the NAS, and new scheduled tasks. On an appliance that should mostly serve files and run a fixed set of containers, the baseline is quiet enough that a shell spawned by the web panel stands out. This is the same instinct that pays off with other host-level escapes: the host should not be surprising you with new processes.
Unraid sits in a lot of homelabs and small-business racks, which is exactly why it is worth treating this as today's work rather than next month's. The fix is one version bump. The harder, more durable change is deciding that a storage appliance's control panel does not belong on the open internet.