Is CVE-2026-14818 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14818 being exploited in the wild.

How severe is CVE-2026-14818?

High severity, with a CVSS score of 7.2, published 4 August 2026.

Which products and versions are affected?

Zyxel ATP V4.32 to V5.42 Patch 1; Zyxel USG FLEX V4.50 to V5.42 Patch 1; Zyxel USG FLEX 50(W) V4.16 to V5.42 Patch 1; Zyxel USG20(W)-VPN V4.16 to V5.42 Patch 1.

Is there a fix for CVE-2026-14818?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-14818 attacked?

It is attacked over the network.

Am I affected by CVE-2026-14818?

Check whether you run Zyxel ATP, Zyxel USG FLEX, Zyxel USG FLEX 50(W) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14818: Zyxel ZLD firewall path traversal in configuration execution

CVE-2026-14818 · Severity: high · CVSS 7.2 · Published 2026-08-04

Zyxel's ZLD firewall series (ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN models) contain a path traversal vulnerability in their CLI command for executing configuration files. An authenticated administrator could exploit this to execute malicious configuration files on affected devices, potentially compromising the firewall's integrity and the networks it protects. The vulnerability affects firmware versions from mid-2021 through early 2026.

Vendors: Zyxel.

Quick answers

Is CVE-2026-14818 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14818 being exploited in the wild.
How severe is CVE-2026-14818?: High severity, with a CVSS score of 7.2, published 4 August 2026.
Which products and versions are affected?: Zyxel ATP V4.32 to V5.42 Patch 1; Zyxel USG FLEX V4.50 to V5.42 Patch 1; Zyxel USG FLEX 50(W) V4.16 to V5.42 Patch 1; Zyxel USG20(W)-VPN V4.16 to V5.42 Patch 1.
Is there a fix for CVE-2026-14818?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-14818 attacked?: It is attacked over the network.
Am I affected by CVE-2026-14818?: Check whether you run Zyxel ATP, Zyxel USG FLEX, Zyxel USG FLEX 50(W) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in the CLI command responsible for executing configuration files in Zyxel ZLD firewall firmware. The vulnerability allows an authenticated attacker with administrator privileges to craft a malicious configuration file and execute it on the affected device, likely by bypassing intended path restrictions. The attack requires network access to the device's management interface and valid administrator credentials. Patches are available as ZLD V5.43 for affected product lines, with earlier vulnerable versions spanning from V4.16 to V5.42 Patch 1 depending on the specific firewall model.

Affected products

Zyxel ATP V4.32 to V5.42 Patch 1
Zyxel USG FLEX V4.50 to V5.42 Patch 1
Zyxel USG FLEX 50(W) V4.16 to V5.42 Patch 1
Zyxel USG20(W)-VPN V4.16 to V5.42 Patch 1

Timeline

2026-08-04: disclosed

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-path-traversal-vulnerability-in-the-configuration-file-execution-cli-command-of-zld-firewalls-08-04-2026

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.