CVE-2026-14818

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-04 · updated 2026-08-04
Weakness: CWE-22

Description

A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX series firmware versions from V4.50 through V5.42 Patch 1, USG FLEX 50(W) series firmware versions from V4.16 through V5.42 Patch 1, and USG20(W)-VPN series firmware versions from V4.16 through V5.42 Patch 1 could allow an authenticated attacker with administrator privileges to execute a crafted malicious configuration file on an affected device.

Affected products

Zyxel ATP series firmware: from from V4.32 through V5.42 Patch 1
Zyxel USG20(W)-VPN series firmware: from from V4.16 through V5.42 Patch 1
Zyxel USG FLEX 50(W) series firmware: from from V4.16 through V5.42 Patch 1
Zyxel USG FLEX series firmware: from from V4.50 through V5.42 Patch 1

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-path-traversal-vulnerability-in-the-configuration-file-execution-cli-command-of-zld-firewalls-08-04-2026

Get alerted when CVE-2026-14818 or the next vulnerability affects your stack