CVE-2026-15733
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk96th percentile - higher than 96% of all known CVEs
Summary
A Remote Code Execution (RCE) vulnerability exists in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to execute arbitrary commands as root.
Risk Assessment
The risk for the organization includes complete compromise of the server running WGDashboard, which could lead to confidentiality, integrity, and availability breaches, as well as further attacks within the network.
Recommendation
It is recommended to immediately update WGDashboard to the latest version that does not contain this vulnerability, and restrict access to the dashboard to trusted users only.
Other vulnerabilities in WGDashboard
See all- CVE-2026-15734Critical
A Server-Side Template Injection (SSTI) vulnerability in WGDashboard version 4.3.2 and earlier allows authenticated attackers to execute arbitrary code as root.
- CVE-2026-15732Critical
A Server-Side Request Forgery (SSRF) vulnerability exists in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses.
- CVE-2026-44343Critical
WGDashboard, a dashboard for managing WireGuard VPN, prior to version 4.3.2 had critical vulnerabilities that could allow unauthorized parties to access the host file system without authentication.
Original NVD description (English source)
A Remote Code Execution (RCE) vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to execute arbitrary commands as root.