Exploited vulnerabilitiesBriefConfirmed by two or more outlets
nginx-ui “MCPwn” (CVE-2026-33032)
The MCP message endpoint had no authentication, so attackers could take over the web server.
- Disclosed
What happened (also listed in 4)
- The MCP message endpoint had no authentication, so attackers could take over the web server. CVSS 9.8.
- Exploited from Mar 2026 (Recorded Future). In VulnCheck KEV. CISA KEV not confirmed.
Live scores
Live scores
CVE-2026-33032- EPSS
- 0.353
likely to be attacked soon - VEDAS
- 0.981
strong exploit evidence - On CISA KEV
- Not listed
Sources
- https://pluto.security/blog/mcp-servers-exploited-enterprise-risk/
- https://nvd.nist.gov/vuln/detail/CVE-2026-33032
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.