Is CVE-2026-121615 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121615 being exploited in the wild.

How severe is CVE-2026-121615?

Critical severity, with a CVSS score of 10, published 4 November 2026.

Is there a fix for CVE-2026-121615?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-121615 attacked?

It is attacked over the network.

Am I affected by CVE-2026-121615?

Check whether you run Linksys E5600 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121615: Linksys E5600 authentication bypass in mesh login

CVE-2026-121615 · Severity: critical · CVSS 10 · Published 2026-11-04

Linksys E5600 is a wireless mesh router sold to small businesses and home users. The device's login handler contains a flaw that allows an unauthenticated attacker to obtain a fully privileged administrator session without knowing the password. An attacker can remotely exploit this to gain complete control of the router and modify network settings, potentially intercepting traffic or deploying malware.

Technologies: Linksys E5600. Vendors: Linksys.

Quick answers

Is CVE-2026-121615 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121615 being exploited in the wild.
How severe is CVE-2026-121615?: Critical severity, with a CVSS score of 10, published 4 November 2026.
Which products and versions are affected?: Linksys E5600 1.1.0.26.
Is there a fix for CVE-2026-121615?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-121615 attacked?: It is attacked over the network.
Am I affected by CVE-2026-121615?: Check whether you run Linksys E5600 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The /cgi-bin/mesh_login.cgi endpoint performs account lookup but fails to propagate failure when no matching account is found, leaving credential buffers zeroed. The authentication comparison then evaluates attacker-supplied username and password against these empty values (SHA256("") and empty string), allowing bypass via a public constant. This is a pre-authentication network-accessible vulnerability (CWE-287) affecting firmware 1.1.0.26 and potentially chaining to command injection flaws for unauthenticated remote code execution.

Affected products

Linksys E5600 1.1.0.26

Timeline

2026-11-04: disclosed: Public disclosure on GitHub
2026-10-10: other: Vulnerability discovered via static reverse engineering

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.