Critical Nginx UI Vulnerability Exposes Server Backups and Sensitive Data

**Executive Summary:** CVE-2026-27944 is a critical (CVSS 9.8) unauthenticated vulnerability in the Nginx UI /api/backup endpoint that returns encrypted server backups together with the AES key and IV in the X-Backup-Security response header, enabling attackers to download and instantly decrypt archives containing credentials, configuration, and private SSL keys; versions prior to 2.3.2 are affected and 2.3.3 contains a patch, and a public proof-of-concept demonstrates exploitation.