Affected Vendors
- Netgear: 13 CVEs
- Palo Alto Networks: 7 CVEs
- Fortinet: 3 CVEs
- GL.iNet: 3 CVEs
- TP-Link: 1 CVE
This week brought 27 new router and network appliance CVEs, with one critical vulnerability demanding immediate attention. While most reported issues carry lower severity ratings, the standout critical flaw in Fortinet equipment and two high-severity GL.iNet vulnerabilities require urgent patching. Netgear dominates the volume with 13 CVEs, though most are rated lower priority.
Critical & High-Priority Vulnerabilities
Fortinet FortiSandbox OS Command Injection (CVE-2026-25089, CVSS 9.8 – Critical)
This is the week's most dangerous vulnerability. An OS command injection flaw in FortiSandbox versions 5.0.0–5.0.5 and 4.4.0–4.4.8 allows attackers to execute arbitrary commands on affected devices. Organizations running these versions should check Fortinet's security advisory immediately and apply patches without delay. This vulnerability can lead to complete system compromise.
GL.iNet GL-MT3000 Remote Code Execution (CVE-2026-12187 & CVE-2026-12186, CVSS 8.8 – High)
Two separate high-severity flaws were identified in GL.iNet's GL-MT3000 router up to firmware version 4.4.5. CVE-2026-12187 involves insecure firmware upgrade functionality in the /usr/bin/one_click_upgrade component, while CVE-2026-12186 affects the Tor proxy configuration service. Both could allow remote attackers to compromise the device. GL.iNet users should upgrade to firmware 4.4.6 or later immediately.
Medium-Severity Issues Across Key Vendors
Fortinet FortiOS Debug Access (CVE-2025-67862, CVSS 6.7) and FortiPortal Access Control (CVE-2026-49938, CVSS 6.5) represent moderate risks in widely deployed platforms. The FortiOS vulnerability affects versions 7.6.0–7.6.2, 7.4.0–7.4.7, and 7.2.0–7.2.x, exposing internal assets to debug-level access. Fortinet customers should prioritize updates to the latest patched firmware versions.
GL.iNet Multi-Model Vulnerability (CVE-2026-11505, CVSS 5.0) affects a broader range of GL.iNet routers including the A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000, and XE3000 models running 4.8.x firmware. The vulnerability exists in the glnassys component and could lead to system manipulation.
Lower-Priority but Notable CVEs
Netgear (13 CVEs): Netgear's 13 CVEs this week span gaming routers, legacy models like the JR6150, and ReadyCloud client functionality. While most carry CVSS scores below 7.0, CVE-2026-9213 (CVSS 6.9) allows man-in-the-middle attackers to execute code on gaming routers. Many of these vulnerabilities require local network access or administrator credentials, limiting their immediate threat—but administrators managing Netgear deployments should review their affected models and apply vendor patches.
Palo Alto Networks (7 CVEs): All seven Palo Alto CVEs are rated "none" severity (unscored). CVE-2026-0273 and CVE-2026-0272 involve administrator-level command injection and privilege escalation in PAN-OS, which could still pose risks in environments where admin account compromise is a concern. Review Palo Alto's security advisories for patching guidance.
TP-Link (1 CVE): CVE-2026-9151 (CVSS 8.5) represents an OS command injection in the VPN module of Archer AX models (AX12 v1, AX17 v1, AX18 v1, AX1300 v1.6). While classified as "none" severity in the CVSS system, the technical rating of 8.5 reflects a serious vulnerability. Authenticated attackers on the adjacent network can execute commands.
Recommendations
- Immediate action: Patch Fortinet FortiSandbox for CVE-2026-25089 and GL.iNet GL-MT3000 for CVE-2026-12187 & CVE-2026-12186.
- This week: Update Fortinet FortiOS and FortiPortal to the latest patched versions; review and apply Netgear patches for affected models in your fleet.
- Ongoing: Monitor RouterCVE for follow-up advisories from Palo Alto, TP-Link, and Fortinet as patches become available.