CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Called exploited the same day it was disclosed.
Measured from the CVE publication date to the earliest of 1 KEV catalogue that list it.
The life of this vulnerability
- CVE published
- First KEV listingsame day
- Last sighting26d
Gaps are compressed to equal steps. The elapsed time is printed under each.
Which catalogues call it exploited
- CISA KEVUS federaldoes not list it
- EUVDENISA, European Uniondoes not list it
- VulnCheck KEVcommercial researchlisted Jul 7, 2026
- CIRCLaggregator, mirrors the abovelisted Jul 31, 2026, not counted
This rests on a single catalogue. No second catalogue corroborates the claim that it is being exploited. CIRCL is an aggregator and is not counted.
Public exploitation evidence
- reported exploitationdashboard.shadowserver.org/statistics/honeypot/vulnerability
- reported exploitationdashboard.shadowserver.org/statistics/honeypot/vulnerability
- reported exploitationprevidian.com/CVE-2026-59800
- reported exploitationwww.cve.org/CVERecord?id=CVE-2026-59800
4 public reports collected from VulnCheck and CIRCL, first on Jul 7, 2026. Each links to its original source. We have not verified them.
Description
9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a 'sudo -S sh' child process. When sudo does not prompt for a password (the process runs as root, NOPASSWD is configured, or a recent sudo timestamp cache exists), the sudoPassword value is interpreted by sh as a shell command, allowing a remote unauthenticated attacker to execute arbitrary OS commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-0