What’s Vulnerable › Vulnerabilities

CVE-2026-11731: Authentication Bypass Vulnerability in Certain NETGEAR RAX Series Models

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-13 · updated 2026-10-16
• Weakness: CWE-288

Description

An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions.

Affected products

• NETGEAR RAX28: before v1.0.15.110 — fixed in v1.0.15.110
• NETGEAR RAX29: before v1.0.15.110 — fixed in v1.0.15.110
• NETGEAR RAX30: before v1.0.15.110 — fixed in v1.0.15.110

How to fix

Upgrade to a fixed version: NETGEAR RAX28 v1.0.15.110; NETGEAR RAX29 v1.0.15.110; NETGEAR RAX30 v1.0.15.110. Check the vendor advisory for mitigations.

References

• https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisory
• https://www.netgear.com/support/product/rax30

Get alerted when CVE-2026-11731 or the next vulnerability affects your stack