What’s Vulnerable › Vulnerabilities

CVE-2026-86300: Tenda AC9 Web Management R7WebsSecurityHandler improper authentication

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-07 · updated 2026-09-08
• Weakness: CWE-287

Description

A flaw has been found in Tenda AC9 15.03.05.14. This impacts the function R7WebsSecurityHandler of the component Web Management. This manipulation causes improper authentication. The attack may be initiated remotely. The exploit has been published and may be used.

Affected products

• Tenda AC9: 15.03.05.14

References

• https://github.com/limou89/somevul/blob/main/Tenda_AC9_fast_setting_wifi_set_Unauth_Password.md
• https://github.com/limou89/somevul/blob/main/Tenda_AC9_getProduct_Info_Disclosure.md
• https://vuldb.com/cve/CVE-2026-86300
• https://vuldb.com/submit/906606
• https://vuldb.com/submit/906607
• https://vuldb.com/submit/906608
• https://vuldb.com/vuln/399464
• https://vuldb.com/vuln/399464/cti
• https://www.tenda.com.cn/
• https://github.com/limou89/somevul/blob/main/Tenda_AC9_getProduct_Info_Disclosure.md

Get alerted when CVE-2026-86300 or the next vulnerability affects your stack