What’s Vulnerable › Vulnerabilities

CVE-2026-16876

• Severity: critical (CVSS 9.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-07 · updated 2026-09-09
• Weakness: CWE-306

Description

An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. A user could bypass authentication and execute arbitrary CLI commands by tampering with WebGUI messages and sending them to the device via internet.

Affected products

• NEC Corporation UNIVERGE IX-R/IX-V: from All versions from Ver1.1 through Ver1.3, All versions from Ver1.4.21 through Ver1.4.28 and Ver1.5.23

References

• https://jpn.nec.com/security-info/secinfo/nv26-005_en.html

Get alerted when CVE-2026-16876 or the next vulnerability affects your stack