External risk intelligence

66Uptime Ping-Servers Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-39117

66Uptime is a web-based monitoring application designed to be internet-facing to monitor the uptime and availability of external websites and services. As a web application that resides on an internet-accessible server to perform its primary function, it is commonly exposed to the public internet.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An unauthenticated code execution vulnerability has been identified in the 66Uptime software and its ping-servers plugin, potentially allowing remote attackers to run unauthorized commands on affected systems. This issue holds a critical severity rating due to its potential for widespread impact if exploited. The main concern is confirming if this specific software is in use and, if so, understanding the exposure.

Remote code execution flaw found in monitoring software.
Critical flaw could impact systems if used.
Confirm if your systems use this software.

Attack Path

How an attacker could exploit the issue

A remote attacker could exploit this vulnerability by sending a crafted request to the `index.php` endpoint without needing any special privileges or user interaction. Successful exploitation would allow the attacker to execute arbitrary code on the server.

Requires network access.
Triggered via `index.php`.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could execute arbitrary code on the affected system when supported by the advisory. This could impact system data, user data, service behavior, or sensitive information.

System data and services at risk.
Via network exploitation.
Unauthorized code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability likely impacts teams responsible for web application security and server infrastructure, including application owners, platform teams, and potentially network or security operations. The immediate priority is to identify all instances of the affected software, determine their exposure and business criticality, and then confirm the accountable owner to coordinate remediation.

Application and platform teams should own remediation.
Verify external reachability and business impact.
Plan maintenance for expedited patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is 66Uptime?

66Uptime is a web-based monitoring tool that tracks the availability and status of external websites and services. Organizations deploy it on servers to automatically poll other sites, ensuring they remain online. Because it must communicate with the public internet to perform these connectivity checks, it is typically hosted on infrastructure reachable from the web.

What does CWE-94 mean for CVE-2026-39117?

CWE-94 refers to improper control of generation of code, often called code injection. In this specific case, the vulnerability allows an attacker to send malicious input that the application processes as executable instructions. This effectively grants the attacker the ability to run arbitrary commands directly on the server hosting the software.

How is the vulnerability triggered?

The flaw is triggered by sending a specially crafted network request to the index.php file of the application. It does not require any prior authentication, special user privileges, or interaction from a legitimate user to initiate. Note that the issue resides within the application code itself, not in the underlying server operating system.

Is my instance at risk?

If you are running the affected versions of 66Uptime or the ping-servers plugin, your system is potentially at risk. According to Halo Surface Signal, this software is often deployed in an internet-facing configuration to fulfill its monitoring purpose, which may increase the likelihood that an attacker can reach the vulnerable endpoint over the network.

What steps should I take to secure my systems?

First, conduct an inventory to identify all installations of 66Uptime and the ping-servers plugin within your environment. Verify whether these instances are accessible from the internet and assess their business impact. Coordinate with the relevant application or platform owners to schedule maintenance and apply the necessary security updates to address this flaw.

References

www.glimmernet.com/security/gt-2026-001-ssrf-66uptime-ping-servers/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.