# CVE-2026-11731: NETGEAR RAX series authentication bypass in management service

Source: https://junglewise.ai/threats/cve-2026-11731-an-authentication-bypass-vulnerability-in-the-listed-netgear-rax  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-11731 · Severity: high · CVSS 8.8 · Published 2026-10-13

A flaw in NETGEAR's RAX series WiFi routers allows an unauthenticated attacker with wireless network access to bypass authentication and access the device's management interface. An attacker could read sensitive device configuration, change administrative settings, or disable management functions without knowing any passwords.

Technologies: [NETGEAR Rax28](https://junglewise.ai/threats/technologies/rax28), [NETGEAR Rax29](https://junglewise.ai/threats/technologies/rax29), [NETGEAR RAX30](https://junglewise.ai/threats/technologies/rax30). Vendors: [NETGEAR](https://junglewise.ai/threats/vendors/netgear).

## Quick answers

**Is CVE-2026-11731 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11731 being exploited in the wild.

**How severe is CVE-2026-11731?** High severity, with a CVSS score of 8.8, published 13 October 2026.

**Which products and versions are affected?** NETGEAR Rax28 prior to v1.0.15.110; NETGEAR Rax29 prior to v1.0.15.110; NETGEAR RAX30 prior to v1.0.15.110.

**Is there a fix for CVE-2026-11731?** Yes: fixed in RAX28 v1.0.15.110, RAX29 v1.0.15.110, RAX30 v1.0.15.110. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-11731 attacked?** It is attacked from the adjacent network or over the network, in a network appliance.

**Am I affected by CVE-2026-11731?** Check whether you run NETGEAR Rax28, NETGEAR Rax29 or NETGEAR RAX30 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in RAX28 v1.0.15.110, RAX29 v1.0.15.110, RAX30 v1.0.15.110

## Technical details

An authentication bypass vulnerability in the management service of affected RAX routers permits unauthenticated attackers with adjacent network access (e.g., WiFi proximity) to access the web management portal and modify settings or read device information. The vulnerability requires no user interaction or prior authentication. Patches are available in firmware v1.0.15.110 for RAX28, RAX29, and RAX30 models.

## Affected products

- NETGEAR RAX28 prior to v1.0.15.110
- NETGEAR RAX29 prior to v1.0.15.110
- NETGEAR RAX30 prior to v1.0.15.110

## Timeline

- 2026-10-13: disclosed: Disclosed in NETGEAR October 2026 Security Advisory

## References

- [https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisory](https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisory)
- [https://www.netgear.com/support/product/rax30](https://www.netgear.com/support/product/rax30)

## Related threats

- [NETGEAR RAX/CAX router insufficient input validation in Block Sites](https://junglewise.ai/threats/cve-2026-11732-an-insufficient-input-validation-vulnerability-in-the-website)
- [NETGEAR RAX series insufficient input validation in management UI](https://junglewise.ai/threats/cve-2026-9216-netgear-rax-series-insufficient-input-validation-in-management-ui)
- [NETGEAR Nighthawk and Orbi routers command injection vulnerability](https://junglewise.ai/threats/cve-2026-11814-netgear-nighthawk-and-orbi-routers-command-injection)
- [Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected…](https://junglewise.ai/threats/cve-2026-11738-insufficient-input-validation-vulnerability-in-the-listed-netgear)
- [Netgear Multiple Routers improper input validation](https://junglewise.ai/threats/cve-2026-9211-netgear-multiple-routers-improper-input-validation)