Affected Vendors This Week
- Palo Alto Networks: 12 CVEs
- Netgear: 9 CVEs
- Fortinet: 7 CVEs
- TP-Link: 5 CVEs
- Zyxel: 4 CVEs
- TRENDnet: 3 CVEs
- Teltonika, OpenWrt/DD-WRT, SonicWall: 2 CVEs each
- Semtech, ASUS, Starlink, Cisco: 1 CVE each
This week brought 50 new router and security appliance CVEs, including three critical vulnerabilities that demand immediate attention. The threat landscape spans authentication bypass flaws, OS command injection, and privilege escalation issues across major vendors.
Critical Vulnerabilities Requiring Urgent Action
CVE-2026-72842 (CVSS 9.9) — OpenWrt's luci-app-lxc contains an ACL inconsistency that allows low-privileged authenticated users to access backend container management routes without authorization checks. This is the highest-scored vulnerability this week and affects container-enabled OpenWrt deployments. Administrators should prioritize patching immediately if LXC is enabled.
CVE-2026-26035 (CVSS 9.8) — Fortinet FortiWeb suffers an improper authentication vulnerability across multiple versions (8.0.0–8.0.2, 7.6.0–7.6.6, 7.4.0–7.4.11, 7.2.0–7.2.12). This allows attackers to bypass authentication entirely. If you run FortiWeb, check your version immediately and apply patches from Fortinet.
CVE-2026-13206 (CVSS 9.8) — Zyxel WAH7601 devices are vulnerable to OS command injection. An attacker can execute arbitrary commands on affected units. Zyxel users should check firmware versions and update as soon as patches become available.
High-Severity Issues Across Multiple Vendors
Fortinet: Beyond the critical FortiWeb issue, Fortinet had two high-severity flaws this week. CVE-2026-70468 is an authentication bypass in FortiManager affecting versions 7.6.1, 7.4.3–7.4.5, 7.2.5–7.2.9, and cloud versions. CVE-2026-70465 is a classic buffer overflow in FortiClientWindows 7.4.0–7.4.3 and 7.2.0–7.2.11. Both warrant timely patching.
Zyxel WAH7601: Beyond the critical command injection, this device also carries CVE-2026-12984 (CVSS 8.2), an insufficiently protected credentials vulnerability allowing attackers to retrieve sensitive embedded data, and CVE-2026-6374 (CVSS 7.3), a hard-coded credentials issue. WAH7601 administrators should plan for comprehensive firmware updates.
Cisco Secure Firewall: CVE-2026-20349 (CVSS 8.6) is an unauthenticated remote access vulnerability in the SSL VPN service for Cisco ASA and FTD Software. This could allow attackers to bypass VPN authentication. Check your Cisco security advisories for patched versions.
SonicWall Email Security: Two identical code injection vulnerabilities (CVE-2026-66149 and CVE-2026-66150, both CVSS 7.8) allow authenticated attackers to inject and execute code. If you manage SonicWall Email Security appliances, validate user access controls and apply patches promptly.
OpenWrt LuCI: CVE-2026-72840 (CVSS 8.8) reveals an overly permissive ACL in luci-mod-system-mounts that grants write access to /etc/crontabs/root to low-privileged users. This could enable privilege escalation. OpenWrt users should update their LuCI modules.
Medium and Lower Severity Findings
Fortinet FortiOS carries three medium-severity issues: CVE-2026-71407 (stack buffer overflow, CVSS 5.6), CVE-2026-71408 (resource exhaustion, CVSS 5.3), and CVE-2026-70466 (input validation bypass in FortiWeb, CVSS 5.3). TP-Link Aginet devices show multiple medium-to-high issues across their web interfaces, including authentication bypass (CVE-2025-30237, CVSS 8.7) and hardcoded crypto keys (CVE-2025-30239, CVSS 8.5).
Netgear contributed nine CVEs, though most are rated "none" or low severity. They include command injection and buffer overflow issues affecting Nighthawk and R7000 models. TRENDnet and Teltonika also had lower-severity findings affecting file permissions and protocol handling.
Recommended Actions
- Fortinet and Zyxel users: Treat FortiWeb 26035 and Zyxel WAH7601 vulnerabilities as critical—patch immediately.
- OpenWrt deployments: Update LuCI modules to patch CVE-2026-72842 and CVE-2026-72840, especially if running container services.
- Cisco ASA/FTD administrators: Review CVE-2026-20349 patch status for your VPN endpoints.
- Routine patching: Schedule firmware updates for TP-Link Aginet, Netgear, and TRENDnet devices this week.
- Inventory check: Use RouterCVE to cross-reference your device models against this week's advisories.