Affected Vendors This Week
- Palo Alto Networks: 12 CVEs (1 high, 11 medium)
- Fortinet: 11 CVEs (1 critical, 4 high, 6 medium)
- Netgear: 6 CVEs (5 medium, 1 low)
- Ubiquiti: 6 CVEs (2 high, 3 medium, 1 low)
- Linksys: 5 CVEs (1 critical, 4 high)
- OpenWrt / DD-WRT: 2 CVEs (1 medium, 1 none)
- Cisco: 2 CVEs (1 critical, 1 medium)
- SonicWall: 2 CVEs (2 high)
- TRENDnet: 2 CVEs (2 critical, 1 high)
- Teltonika, Semtech, TP-Link, Lantronix: 1 CVE each
This week brought 52 new router and network appliance vulnerabilities, including 5 critical findings. A concerning trend emerges: multiple vendors in the small-office and SMB router space (Linksys, TRENDnet) are shipping firmware with critical pre-authentication command injection and file write vulnerabilities. Meanwhile, enterprise-grade appliances from Fortinet, Cisco, and Palo Alto Networks continue to accumulate medium and high-severity issues, many involving SQL injection and path traversal flaws.
Critical Vulnerabilities Requiring Immediate Action
Linksys E1700 (5 CVEs, including 1 critical): The Linksys E1700 firmware version 1.0.0.4.003 contains multiple unauthenticated command injection vulnerabilities in web management CGI handlers. CVE-2026-108892 (CVSS 10.0) affects the MAC filter function, while CVE-2026-108895, CVE-2026-108893, CVE-2026-108894, and CVE-2026-108896 target DMZ, VLAN, static routing, and IPv6 configuration functions respectively—all scoring 9.9. An attacker on the local network can execute arbitrary commands with root privileges without authentication. Action: Check for firmware updates immediately. If running E1700 1.0.0.4.003, isolate affected devices from untrusted networks until patched.
TRENDnet TEW-751DR, TEW-752DRU, TEW-733GR (2 CVEs, both critical): CVE-2026-108804 (CVSS 10.0) allows arbitrary file writes via an unauthenticated fwrite call in the pigwidgeon.cgi web backend on firmware versions 1.03B01 and 1.03B03. CVE-2026-109157 (CVSS 9.9) in the older TEW-432BRP affects TCP/IP setup. These are pre-authentication remote code execution vectors affecting a range of TRENDnet consumer and prosumer devices. Action: Contact TRENDnet support for emergency firmware updates. Consider temporary network segmentation until patches are released.
Cisco Secure Email Gateway (CVE-2026-76519, CVSS 9.8): The Advanced Malware Protection (AMP) feature allows unauthenticated remote attackers to write arbitrary files on the underlying operating system. This could lead to code execution or system compromise in email gateways. Action: Prioritize patching Cisco appliances in your environment; check Cisco's security advisories for available fixes.
Fortinet FortiSIEM (CVE-2026-106173, CVSS 9.8): A path traversal vulnerability in FortiSIEM 7.5.0 enables attackers to execute unauthorized code or commands via specially crafted input. SIEM appliances often have deep network visibility; compromise here could expose sensitive log data and enable lateral movement. Action: Upgrade FortiSIEM beyond 7.5.0 as soon as possible.
Lantronix XPress-DR / XPress-DR-I (CVE-2026-109439, CVSS 9.8): Firmware through version 8.1.0.0 lacks authentication, allowing remote attackers to read and overwrite device configuration persistently. These are often used in industrial and remote management scenarios. Action: Update to firmware 8.1.1.0 or later; verify network access controls restrict administrative interfaces to trusted IPs only.
High-Severity Issues by Vendor
Palo Alto Networks (12 CVEs): CVE-2026-0322 (CVSS 8.6) is a management interface RCE affecting PAN-OS requiring authentication. The remaining 11 are medium-severity issues, including denial-of-service flaws (CVE-2026-0321), command injection (CVE-2026-0320, CVE-2026-0313), and privilege escalation (CVE-2026-0315) across PAN-OS, Cortex XSOAR, and GlobalProtect. Action: Apply PAN-OS updates according to your patch cycle; prioritize systems exposed to untrusted networks.
Fortinet (11 CVEs): Beyond the critical FortiSIEM issue, four high-severity SQL injection vulnerabilities affect FortiMail (CVE-2025-57739, CVSS 8.8), FortiAnalytics (CVE-2025-46773, CVSS 8.8; CVE-2026-23705, CVE-2026-23707, both CVSS 7.2), and FortiManager (CVE-2026-106171, CVSS 6.1). SQL injection in these contexts could expose credentials, configuration data, or enable further compromise. Action: Review Fortinet patch schedules for affected products and prioritize FortiMail updates.
Ubiquiti UniFi Protect (6 CVEs): The UniFi Protect AI Key has improper access control (CVE-2026-110459, CVSS 8.6; CVE-2026-110454, 5.3) and input validation weaknesses (CVE-2026-110455, CVSS 8.1). These allow network-adjacent attackers to extract information or access internal resources. Path traversal issues (CVE-2026-110458, CVE-2026-110457) exist but are lower risk. Action: Update UniFi Protect firmware and verify camera system network isolation.
Netgear (6 CVEs): RAX series routers have an authentication bypass (CVE-2026-11731, CVSS 8.8) and website blocking bypass (CVE-2026-11732, CVSS 8.8) affecting adjacent network attackers. R7300 routers have input validation issues in PPPoE and LAN setup (both CVSS 4.5). Action: Check for Netgear firmware updates for your router model; apply network access controls to restrict admin interfaces.
SonicWall NSM (2 CVEs): CVE-2026-96540 (CVSS 8.8) is an access control flaw in export settings; CVE-2026-100232 (CVSS 7.2) is post-authentication OS command injection. Action: Apply SonicWall security updates and restrict NSM console access to authorized administrators only.
Teltonika RUTOS (CVE-2026-75826, CVSS 8.5): Command injection in the backup function affects RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2. Update to patched versions immediately.
Medium and Low-Severity Items
OpenWrt's odhcpd (CVE-2026-53922, CVSS 6.5) has an unauthenticated DHCPv6 issue on local networks. TP-Link extenders use weak XOR-based encryption in login flows (CVE-2026-109506, CVSS 5.9). Semtech's LR11xx transceiver firmware has an out-of-bounds write (CVE-2026-6232, CVSS 5.2). These warrant monitoring but are lower priority unless you operate the specific affected models.
Bottom line: This week demands urgent attention to Linksys E1700, TRENDnet, and the critical Cisco/Fortinet/Lantronix issues. Coordinate with your vendors for patches and apply network segmentation in the interim.