Is CVE-2026-15427 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15427 being exploited in the wild.

How severe is CVE-2026-15427?

Informational severity, with a CVSS score of 8.6, published 14 July 2026.

Which products and versions are affected?

TP-Link Archer VX1800v < 0.16.0 2.0.0 v6092.0 Build 260521 RC.7927n.

Is there a fix for CVE-2026-15427?

A patch was published on 2026-05-21: Firmware build date for the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-15427 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-15427?

Check whether you run TP-Link Archer VX1800v at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15427: TP-Link Archer VX1800v OS command injection in TR-069 interface

Q: Is there a fix for CVE-2026-15427?

A patch was published on 2026-05-21: Firmware build date for the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-15427 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-15427?

Check whether you run TP-Link Archer VX1800v at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15427 · Severity: info · CVSS 8.6 · Published 2026-07-14

TP-Link Archer VX1800v routers are affected by a security flaw in their remote management interface, which is typically used by internet service providers to manage home equipment. If an attacker gains control over the management server used by the provider, they can send malicious commands to the router. Successful exploitation allows the attacker to take full control of the device, potentially leading to data interception or service disruption.

Technologies: TP-Link Archer VX1800v. Vendors: TP-Link.

Quick answers

Is CVE-2026-15427 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15427 being exploited in the wild.
How severe is CVE-2026-15427?: Informational severity, with a CVSS score of 8.6, published 14 July 2026.
Which products and versions are affected?: TP-Link Archer VX1800v < 0.16.0 2.0.0 v6092.0 Build 260521 RC.7927n.
Is there a fix for CVE-2026-15427?: A patch was published on 2026-05-21: Firmware build date for the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15427 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-15427?: Check whether you run TP-Link Archer VX1800v at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists in the TR-069 (CWMP) management interface of the TP-Link Archer VX1800v v1. The flaw stems from insufficient validation and sanitization of parameters delivered via the CWMP protocol. To exploit this, an attacker must be able to influence commands delivered by an Auto Configuration Server (ACS), which typically requires compromising or controlling the ACS itself. If successful, the attacker can execute arbitrary system-level commands with root privileges, leading to a complete compromise of the Linux-based firmware. The issue is resolved in firmware version 0.16.0 2.0.0 v6092.0 Build 260521 RC.7927n or later.

Affected products

TP-Link Archer VX1800v v1 < 0.16.0 2.0.0 v6092.0 Build 260521 RC.7927n

Timeline

2026-07-14: advisory: Initial advisory published by TP-Link and NVD
2026-05-21: patched: Firmware build date for the fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.