What’s Vulnerable › Vulnerabilities

CVE-2026-11736: Stack-based buffer overflow vulnerability in some NETGEAR Nighthawk routers

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-11 · updated 2026-09-09
• Weakness: CWE-20

Description

A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router software and functionality.

Affected products

• NETGEAR Rax20 Firmware: all versions
• NETGEAR Rax35V2 Firmware: before 1.0.16.132 — fixed in 1.0.16.132
• NETGEAR Rax41 Firmware: all versions
• NETGEAR Rax41V2 Firmware: before 1.1.4.28 — fixed in 1.1.4.28
• NETGEAR Rax42 Firmware: all versions
• NETGEAR Rax42V2 Firmware: before 1.1.4.28 — fixed in 1.1.4.28
• Netgear RAX43: before 1.0.16.132 — fixed in 1.0.16.132
• NETGEAR Rax43V2 Firmware: before 1.1.4.28 — fixed in 1.1.4.28
• NETGEAR Rax45 Firmware: all versions
• NETGEAR Rax49S Firmware: before 1.1.4.28 — fixed in 1.1.4.28
• NETGEAR Rax50 Firmware: before 1.0.16.132 — fixed in 1.0.16.132
• NETGEAR Rax50S Firmware: all versions
• NETGEAR Rax50V2 Firmware: before 1.1.4.28 — fixed in 1.1.4.28
• NETGEAR Rax54Sv2 Firmware: before 1.1.4.28 — fixed in 1.1.4.28
• NETGEAR Rax54V2 Firmware: before 1.1.4.28 — fixed in 1.1.4.28
• NETGEAR Raxe450 Firmware: all versions
• NETGEAR Raxe500 Firmware: before 1.2.14.114 — fixed in 1.2.14.114
• NETGEAR Xr1000 Firmware: before 1.1.0.22 — fixed in 1.1.0.22
• NETGEAR XR1000v2: before 1.1.0.22 — fixed in 1.1.0.22

How to fix

Upgrade to a fixed version: NETGEAR Rax35V2 Firmware 1.0.16.132; NETGEAR Rax41V2 Firmware 1.1.4.28; NETGEAR Rax42V2 Firmware 1.1.4.28; Netgear RAX43 1.0.16.132; NETGEAR Rax43V2 Firmware 1.1.4.28; NETGEAR Rax49S Firmware 1.1.4.28; NETGEAR Rax50 Firmware 1.0.16.132; NETGEAR Rax50V2 Firmware 1.1.4.28; NETGEAR Rax54Sv2 Firmware 1.1.4.28; NETGEAR Rax54V2 Firmware 1.1.4.28; NETGEAR Raxe500 Firmware 1.2.14.114; NETGEAR Xr1000 Firmware 1.1.0.22. Check the vendor advisory for mitigations.

References

• https://kb.netgear.com/000070887/August-2026-NETGEAR-Security-Advisory
• https://www.netgear.com/support/product/rax20/
• https://www.netgear.com/support/product/rax35v2/
• https://www.netgear.com/support/product/rax41/
• https://www.netgear.com/support/product/rax41v2/
• https://www.netgear.com/support/product/rax42/
• https://www.netgear.com/support/product/rax42v2/
• https://www.netgear.com/support/product/rax43/
• https://www.netgear.com/support/product/rax43v2/
• https://www.netgear.com/support/product/rax45/
• https://www.netgear.com/support/product/rax49s/
• https://www.netgear.com/support/product/rax50/

Get alerted when CVE-2026-11736 or the next vulnerability affects your stack