What’s Vulnerable › Vulnerabilities

CVE-2026-62657: Certificate validation vulnerability in NETGEAR Gaming Router and certain Nighthawk models

• Severity: medium (CVSS 4.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-14 · updated 2026-07-15
• Weakness: CWE-599

Description

A security flaw in the router's certificate validation process was discovered in the NETGEAR XR1000 Gaming Router and certain Nighthawk models that could allow an unauthorized person to remotely access and take control of the device.

Affected products

• NETGEAR MR70: before V1.0.4.48 — fixed in V1.0.4.48
• NETGEAR MS70: before V1.0.4.48 — fixed in V1.0.4.48
• NETGEAR RAXE500: before V1.2.14.114 — fixed in V1.2.14.114
• NETGEAR XR1000: before V1.0.2.86 — fixed in V1.0.2.86

How to fix

Upgrade to a fixed version: NETGEAR MR70 V1.0.4.48; NETGEAR MS70 V1.0.4.48; NETGEAR RAXE500 V1.2.14.114; NETGEAR XR1000 V1.0.2.86. Check the vendor advisory for mitigations.

References

• https://kb.netgear.com/000070859/July-2026-NETGEAR-Security-Advisory
• https://www.netgear.com/support/product/mr70/
• https://www.netgear.com/support/product/ms70/
• https://www.netgear.com/support/product/raxe500/
• https://www.netgear.com/support/product/xr1000/

Get alerted when CVE-2026-62657 or the next vulnerability affects your stack