Is CVE-2026-12489 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12489 being exploited in the wild.

How severe is CVE-2026-12489?

Medium severity, with a CVSS score of 6.5, published 20 October 2026.

Which products and versions are affected?

Zyxel Dx3300-T0 5.50(ABVY.8.2)C0 and earlier; Zyxel Ex3501-T0 through 5.44(ACHR.6)C0; Zyxel Nebula FWA505v2 1.70(ACRH.0)C0 and earlier; Zyxel Nebula Fwa515 1.70(ACPZ.1)C0 and earlier; and 10 more.

Is there a fix for CVE-2026-12489?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12489 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-12489?

Check whether you run Zyxel Dx3300-T0, Zyxel Ex3501-T0, Zyxel Nebula FWA505v2 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12489: Zyxel EX3501-T0 privilege escalation in Data Access Layer

CVE-2026-12489 · Severity: medium · CVSS 6.5 · Published 2026-10-20

Zyxel network devices such as CPEs and wireless extenders contain a flaw in their Data Access Layer that allows authenticated users to escalate their privileges. An attacker with valid login credentials could modify system permissions and gain administrative control of the device, potentially leading to network compromise or unauthorized configuration changes.

Technologies: Zyxel Dx3300-T0, Zyxel Ex3501-T0, Zyxel Nebula Fwa515. Vendors: Zyxel.

Quick answers

Is CVE-2026-12489 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12489 being exploited in the wild.
How severe is CVE-2026-12489?: Medium severity, with a CVSS score of 6.5, published 20 October 2026.
Which products and versions are affected?: Zyxel Dx3300-T0 5.50(ABVY.8.2)C0 and earlier; Zyxel Ex3501-T0 through 5.44(ACHR.6)C0; Zyxel Nebula FWA505v2 1.70(ACRH.0)C0 and earlier; Zyxel Nebula Fwa515 1.70(ACPZ.1)C0 and earlier; and 10 more.
Is there a fix for CVE-2026-12489?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12489 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-12489?: Check whether you run Zyxel Dx3300-T0, Zyxel Ex3501-T0, Zyxel Nebula FWA505v2 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Data Access Layer (DAL) in affected Zyxel firmware improperly validates authorization when modifying login_privilege data. An authenticated attacker can exploit this to escalate privileges without requiring administrative credentials. The vulnerability requires authentication as a precondition but no further user interaction, and affects multiple device families including 5G NR CPE, DSL/Ethernet CPE, Fiber ONTs, and wireless extenders.

Affected products

Zyxel EX3501-T0 through 5.44(ACHR.6)C0
Zyxel NR5111 1.00(ACMP.3)C0, 1.00(ACMP.4)C0
Zyxel NR5307 2.00(ACJT.3)C0, 2.00(ACJT.4)b1
Zyxel NR5309 1.00(ACKP.2)b2, 1.00(ACKP.2)b3
Zyxel NR5313 1.00(ACRC.0)b4, 1.00(ACRC.1)b1
Zyxel NR7302 1.00(ACHA.6)C0, 1.00(ACHA.7)b2
Zyxel NR7303 1.00(ACEI.3)C0, 1.00(ACEI.4)C0
Zyxel NR7305 1.00(ACMM.2)b1, 1.00(ACMM.3)C0
Zyxel NR7307 1.00(ACTO.0)b1, 1.00(ACTO.0)C0
Zyxel NR7701 1.00(ACPK.1)b2, 1.00(ACPK.1)b3
Zyxel Nebula FWA505v2 1.70(ACRH.0)C0 and earlier
Zyxel Nebula FWA515 1.70(ACPZ.1)C0 and earlier
Zyxel Nebula FWA70 1.70(ACRF.0)C0 and earlier
Zyxel DX3300-T0 5.50(ABVY.8.2)C0 and earlier

Timeline

2026-10-20: disclosed

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-incorrect-authorization-vulnerability-in-the-dal-of-certain-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-and-wireless-extenders-10-20-2026

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.