CVE-2026-107795: Improper Authorization in TP-Link Omada Controller TLS Certificate and Private Key Management API

Severity: high (CVSS 7.5 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-14 · updated 2026-10-16
Weakness: CWE-284

Description

Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations. Successful exploitation may allow a low-privileged authenticated user to upload or delete the controller's TLS certificate or private key, potentially disrupting secure management access.

Affected products

TP-Link Systems Inc. Omada Software Controller: before 6.3.0.45 — fixed in 6.3.0.45

How to fix

Upgrade to a fixed version: TP-Link Systems Inc. Omada Software Controller 6.3.0.45. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-107795 or the next vulnerability affects your stack