What’s Vulnerable › Vulnerabilities

CVE-2026-57920

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-06-26 · updated 2026-10-25
• Weakness: CWE-551

Description

Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} endpoints.

Affected products

• Peplink Intcontrol 2: through 2.14.2

References

• https://drive.google.com/file/d/1MoZn73YkDGGpqOgaQbRU1hWVygr8VaxY/view
• https://drive.google.com/file/d/1MoZn73YkDGGpqOgaQbRU1hWVygr8VaxY/view

Get alerted when CVE-2026-57920 or the next vulnerability affects your stack