Critical Unauthenticated RCE and Server Takeover (CVE-2026-33032, CVE-2026-27825)

[Eyal Estrin]

MCPwnfluence: Critical Unauthenticated SSRF to RCE Attack Chain in the Most Widely Used Atlassian MCP Server
https://blog.pluto.security/p/mcpwnfluence-cve-2026-27825-critical

Unauthenticated MCP Endpoint Allows Remote Nginx Takeover
https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h6c2-x2m2-mwhf

MCPwn: A CVSS 9.8 One-Line MCP Bug That Hands Over Your Nginx to Anyone on the Network – Actively Exploited in the Wild
https://pluto.security/blog/mcp-bug-nginx-security-vulnerability-cvss-9-8/

Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server Takeover
https://thehackernews.com/2026/04/critical-nginx-ui-vulnerability-cve.html

Eyal Estrin
Author | Cloud Architect | AWS • Azure • GCP Insights
Social: @eyalestrin
Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com