What’s Vulnerable › Vulnerabilities
CVE-2026-11739: Command injection vulnerability in some NETGEAR Nighthawk devices
- Severity: medium (CVSS 6.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-11 · updated 2026-10-23
- Weakness: CWE-78
Description
A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker in the middle) to compromise the confidentiality and integrity of the affected device.
Affected products
- NETGEAR Mr60 Firmware: before 1.1.8.142 — fixed in 1.1.8.142
- NETGEAR Mr70 Firmware: before 1.0.4.48 — fixed in 1.0.4.48
- NETGEAR Mr90 Firmware: before 1.0.2.46 — fixed in 1.0.2.46
- NETGEAR Ms60 Firmware: before 1.1.8.142 — fixed in 1.1.8.142
- NETGEAR Ms70 Firmware: before 1.0.4.48 — fixed in 1.0.4.48
- NETGEAR Ms90 Firmware: before 1.0.2.46 — fixed in 1.0.2.46
- NETGEAR Rax200 Firmware: before 1.0.11.148 — fixed in 1.0.11.148
- NETGEAR Rax20 Firmware: before 1.0.17.142 — fixed in 1.0.17.142
- NETGEAR Rax35 Firmware: before 1.0.17.142 — fixed in 1.0.17.142
- NETGEAR Rax35V2 Firmware: before 1.0.17.142 — fixed in 1.0.17.142
- NETGEAR Rax41 Firmware: before 1.1.6.36 — fixed in 1.1.6.36
- NETGEAR Rax41V2 Firmware: before 1.1.6.36 — fixed in 1.1.6.36
- NETGEAR Rax42 Firmware: before 1.1.6.36 — fixed in 1.1.6.36
- NETGEAR Rax42V2 Firmware: before 1.1.6.36 — fixed in 1.1.6.36
- Netgear RAX43: before 1.1.6.36 — fixed in 1.1.6.36
- NETGEAR Rax43V2 Firmware: before 1.1.6.36 — fixed in 1.1.6.36
- NETGEAR Rax45 Firmware: before 1.0.17.142 — fixed in 1.0.17.142
- NETGEAR Rax49S Firmware: before 1.1.6.36 — fixed in 1.1.6.36
- NETGEAR Rax50 Firmware: before 1.1.6.36 — fixed in 1.1.6.36
- NETGEAR Rax50V2 Firmware: before 1.1.6.36 — fixed in 1.1.6.36
- NETGEAR Rax54S Firmware: before 1.1.6.36 — fixed in 1.1.6.36
- NETGEAR Rax54Sv2 Firmware: before 1.1.6.36 — fixed in 1.1.6.36
- NETGEAR Rax80 Firmware: before 1.0.11.148 — fixed in 1.0.11.148
- NETGEAR Raxe500 Firmware: before 1.2.14.110 — fixed in 1.2.14.110
- NETGEAR Rs700 Firmware: before 1.0.9.6 — fixed in 1.0.9.6
- NETGEAR Xr1000 Firmware: before 1.1.0.22 — fixed in 1.1.0.22
- NETGEAR XR1000v2: before 1.1.0.22 — fixed in 1.1.0.22
How to fix
Upgrade to a fixed version: NETGEAR Mr60 Firmware 1.1.8.142; NETGEAR Mr70 Firmware 1.0.4.48; NETGEAR Mr90 Firmware 1.0.2.46; NETGEAR Ms60 Firmware 1.1.8.142; NETGEAR Ms70 Firmware 1.0.4.48; NETGEAR Ms90 Firmware 1.0.2.46; NETGEAR Rax200 Firmware 1.0.11.148; NETGEAR Rax20 Firmware 1.0.17.142; NETGEAR Rax35 Firmware 1.0.17.142; NETGEAR Rax35V2 Firmware 1.0.17.142; NETGEAR Rax41 Firmware 1.1.6.36; NETGEAR Rax41V2 Firmware 1.1.6.36. Check the vendor advisory for mitigations.
References
- https://kb.netgear.com/000070887/August-2026-NETGEAR-Security-Advisory
- https://www.netgear.com/support/product/mr60/
- https://www.netgear.com/support/product/mr70/
- https://www.netgear.com/support/product/mr90/
- https://www.netgear.com/support/product/ms60/
- https://www.netgear.com/support/product/ms70/
- https://www.netgear.com/support/product/ms90/
- https://www.netgear.com/support/product/rax20/
- https://www.netgear.com/support/product/rax200/
- https://www.netgear.com/support/product/rax35/
- https://www.netgear.com/support/product/rax35v2/
- https://www.netgear.com/support/product/rax41/
Get alerted when CVE-2026-11739 or the next vulnerability affects your stack