CVE-2026-120276: WAVLINK WN536AX6-A (Critical, CVSS 9.3)

CVE record · updated Nov 2, 2026

CVE-2026-120276CriticalWAVLINK WN536AX6-A

CVSS: 9.3 Critical (v4.0)
Exploited in the wild: Not on CISA’s KEV list
Public exploit: None reported in public exploit databases
Weakness: CWE-77, CWE-78
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Published: Nov 2, 2026

What it is

A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument group_name causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

Description from the National Vulnerability Database.

What to do

Check whether you run WAVLINK WN536AX6-A, then apply the vendor’s fix or mitigation from the advisories below.

Sources: NVD, FIRST EPSS, CISA KEV, and public exploit databases (availability only). ThreatRoundup reports whether public exploit code exists but never links to it: fake proof-of-concepts that infect security researchers are common. This page updates automatically.