Is CVE-2026-19586 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19586 being exploited in the wild.

How severe is CVE-2026-19586?

Critical severity, with a CVSS score of 9.8, published 20 August 2026.

Which products and versions are affected?

TP-Link Omada DR3150 V1 firmware prior to 1.0.1 Build 20260722 Rel.16854; TP-Link Omada DR3220v-4G V1 firmware prior to 1.2.0 Build 20260630 Rel.82652; TP-Link Omada DR3650v V1 firmware prior to 1.2.0 Build 20260630 Rel.83311; TP-Link Omada DR3650v-4G V1 firmware prior to 1.2.0 Build 20260630 Rel.83347; and 14 more.

Is there a fix for CVE-2026-19586?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-19586 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-19586?

Check whether you run TP-Link Omada DR3150, TP-Link Omada DR3220v-4G, TP-Link Omada DR3650v or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19586: TP-Link Omada gateways OS command injection in OpenVPN authentication

CVE-2026-19586 · Severity: critical · CVSS 9.8 · Published 2026-08-20

TP-Link Omada gateways are enterprise-class networking devices that often serve as secure VPN endpoints for remote access to business networks. This vulnerability allows an unauthenticated attacker on the internet to execute arbitrary commands as the root user on any affected gateway with the OpenVPN SSL VPN feature enabled, potentially compromising all network traffic and connected systems.

Vendors: TP-Link.

Quick answers

Is CVE-2026-19586 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19586 being exploited in the wild.
How severe is CVE-2026-19586?: Critical severity, with a CVSS score of 9.8, published 20 August 2026.
Which products and versions are affected?: TP-Link Omada DR3150 V1 firmware prior to 1.0.1 Build 20260722 Rel.16854; TP-Link Omada DR3220v-4G V1 firmware prior to 1.2.0 Build 20260630 Rel.82652; TP-Link Omada DR3650v V1 firmware prior to 1.2.0 Build 20260630 Rel.83311; TP-Link Omada DR3650v-4G V1 firmware prior to 1.2.0 Build 20260630 Rel.83347; and 14 more.
Is there a fix for CVE-2026-19586?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-19586 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-19586?: Check whether you run TP-Link Omada DR3150, TP-Link Omada DR3220v-4G, TP-Link Omada DR3650v or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a pre-authentication OS command injection (CWE-78) in the OpenVPN SSL VPN authentication handler (/usr/sbin/checkpsw.sh). The username submitted during OpenVPN connection establishment is unsafely spliced unquoted into an awk program before password validation occurs, allowing an attacker to inject arbitrary awk commands. An unauthenticated remote attacker can initiate an OpenVPN connection with a malicious username to achieve root-level code execution. The attack requires only network reachability to the VPN service (UDP 1194 by default) with no client certificate, valid credentials, or prior device access needed. TP-Link has released fixed firmware for affected Omada gateway models; until patched, disabling the OpenVPN Server feature or restricting WAN access to the VPN port mitigates the risk.

Affected products

TP-Link Omada ER7212PC V2 firmware prior to 2.4.3 Build 20260722 Rel.40250
TP-Link Omada ER605 V2 firmware prior to 2.4.4 Build 20260630 Rel.14398
TP-Link Omada ER605W V2 firmware prior to 2.0.4 Build 20260723 Rel.43763
TP-Link Omada ER7206 V2 firmware prior to 2.3.5 Build 20260625 Rel.43136
TP-Link Omada ER7406 V1 firmware prior to 1.3.4 Build 20260625 Rel.43136
TP-Link Omada ER707-M2 V1 firmware prior to 1.4.4 Build 20260625 Rel.43063
TP-Link Omada ER7412-M2 V1 firmware prior to 1.2.0 Build 20260630 Rel.82947
TP-Link Omada ER8411 V1 firmware prior to 1.4.1 Build 20260708 Rel.64832
TP-Link Omada ER706W V1 firmware prior to 1.2.11 Build 20260723 Rel.41567
TP-Link Omada ER706W-4G V1 firmware prior to 1.2.6 Build 20260723 Rel.41321; V2 firmware prior to 2.1.11 Build 20260723 Rel.41624
TP-Link Omada ER706WP-4G V1 firmware prior to 1.1.11 Build 20260723 Rel.41624
TP-Link Omada ER703WP-4G-Outdoor V1 firmware prior to 1.1.7 Build 20260723 Rel.41712
TP-Link Omada ER603WP-4G-Outdoor V1 firmware prior to 1.0.2 Build 20260723 Rel.43271
TP-Link Omada ER701-5G-Outdoor V1 firmware prior to 1.0.3 Build 20260723 Rel.40931
TP-Link Omada DR3220v-4G V1 firmware prior to 1.2.0 Build 20260630 Rel.82652
TP-Link Omada DR3650v V1 firmware prior to 1.2.0 Build 20260630 Rel.83311
TP-Link Omada DR3650v-4G V1 firmware prior to 1.2.0 Build 20260630 Rel.83347
TP-Link Omada DR3150 V1 firmware prior to 1.0.1 Build 20260722 Rel.16854

Timeline

2026-08-20: disclosed
2026-08-21: other: Technical analysis published by mattg.systems

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.