How severe is CVE-2026-11739?

CVE-2026-11739 has a CVSS 3.x base score of 6.4, rated medium severity. It is exploitable over an adjacent network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2026-11739 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (64th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-11739?

CVE-2026-11739 primarily affects Netgear Ms90 Firmware. In total, 27 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2026-11739?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-11739 published?

CVE-2026-11739 was published on 2026-08-11 and last updated on 2026-09-09.

CVE-2026-11739

CVE-2026-11739 is a medium-severity vulnerability in Netgear Ms90 Firmware with a CVSS 3.x base score of 6.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-78.

Key facts

Severity: Medium (CVSS 3.x base score 6.4)
CVSS v4: 4.9
EPSS exploit prediction: 1% (64th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-78
Affected product: Netgear Ms90 Firmware
Published: 2026-08-11
Last modified: 2026-09-09

Description

A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker in the middle) to compromise the confidentiality and integrity of the affected device.

Frequently asked questions

What is CVE-2026-11739?: A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker in the middle) to compromise the confidentiality and integrity of the affected device.
How severe is CVE-2026-11739?: CVE-2026-11739 has a CVSS 3.x base score of 6.4, rated medium severity. It is exploitable over an adjacent network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2026-11739 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (64th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-11739?: CVE-2026-11739 primarily affects Netgear Ms90 Firmware. In total, 27 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2026-11739?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-11739 published?: CVE-2026-11739 was published on 2026-08-11 and last updated on 2026-09-09.

References

Affected products (27)

cpe:2.3:o:netgear:ms90_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax20_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax35_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax35v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax41_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax41v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax42_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax42v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax43_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax43v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax45_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax49s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax50_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax50v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax54s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax54sv2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax80_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:raxe500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rs700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:xr1000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:xr1000v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:mr60_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:mr70_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:mr90_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:ms60_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:ms70_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Netgear Ms90 Firmware

CVE-2025-12946 — High (CVSS 7.5): A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation,…
CVE-2026-11734 — Low (CVSS 2.7): A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected…

All CVEs affecting Netgear Ms90 Firmware →

Other CWE-78 (OS Command Injection) vulnerabilities

CVE-2026-100382 — Critical (CVSS 10.0): Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia…
CVE-2026-77521 — Critical (CVSS 10.0): MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool,…
CVE-2026-82004 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS…
CVE-2026-76197 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS…
CVE-2026-76195 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS…
CVE-2026-19188 — Critical (CVSS 10.0): A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The…

Browse all CWE-78 (OS Command Injection) vulnerabilities →