Is CVE-2026-118865 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118865 being exploited in the wild.

How severe is CVE-2026-118865?

Informational severity, published 3 November 2026.

Which products and versions are affected?

TP-Link Archer AX3000 V2 prior to 1.1.3 Build 261026.

Is there a fix for CVE-2026-118865?

Yes: fixed in Archer AX3000 V2: 1.1.3 Build 261026. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118865 attacked?

It is attacked from the adjacent network.

Am I affected by CVE-2026-118865?

Check whether you run TP-Link Archer AX3000 V2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118865: TP-Link Archer AX3000 v2 authenticated OS command injection

CVE-2026-118865 · Severity: info · Published 2026-11-03

The TP-Link Archer AX3000 v2 is a home Wi-Fi router that allows administrators to manage USB storage allocation through an offline download feature. An authenticated administrator can inject malicious shell commands through a crafted path value, gaining complete control over the router's operating system. This could allow an attacker with admin credentials to compromise the router, access sensitive network data, or launch attacks on connected devices.

Vendors: TP-Link.

Quick answers

Is CVE-2026-118865 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118865 being exploited in the wild.
How severe is CVE-2026-118865?: Informational severity, published 3 November 2026.
Which products and versions are affected?: TP-Link Archer AX3000 V2 prior to 1.1.3 Build 261026.
Is there a fix for CVE-2026-118865?: Yes: fixed in Archer AX3000 V2: 1.1.3 Build 261026. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118865 attacked?: It is attacked from the adjacent network.
Am I affected by CVE-2026-118865?: Check whether you run TP-Link Archer AX3000 V2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Archer AX3000 V2: 1.1.3 Build 261026

Technical details

An OS command injection vulnerability exists in the Offline Download component's USB storage allocation function. When a USB device is attached, user-supplied path input containing shell metacharacters is not properly sanitized before being passed to a system command. An authenticated administrator can exploit this to execute arbitrary commands with device privileges. A fix is available in firmware version 1.1.3 Build 261026.

Affected products

TP-Link Archer AX3000 V2 prior to 1.1.3 Build 261026

Timeline

2026-11-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.