# CVE-2026-22226: TP-Link Archer command injection in VPN server configuration

Source: https://junglewise.ai/threats/cve-2026-22226-tp-link-archer-command-injection-in-vpn-server-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-02. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-22226 · Severity: high · CVSS 7.2 · Published 2026-02-02

A security vulnerability has been identified in TP-Link Archer BE230 and AX73 routers, which are used to provide home and small office internet connectivity. An attacker who has already gained administrative access to the router's management interface can execute unauthorized commands through the VPN configuration module. This could allow the attacker to take full control of the device, potentially leading to network eavesdropping, service disruptions, or further attacks on connected devices.

Technologies: [TP-Link Archer Be230](https://junglewise.ai/threats/technologies/archer-be230), [TP-Link Archer Be230 Firmware](https://junglewise.ai/threats/technologies/archer-be230-firmware). Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2026-22226 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-22226 being exploited in the wild.

**How severe is CVE-2026-22226?** High severity, with a CVSS score of 7.2, published 2 February 2026.

**Which products and versions are affected?** TP-Link Archer AX73 v2 < 1.3.1 Build 20260430; TP-Link Archer Be230 v1.2 < 1.2.4 Build 20251218 rel.70420.

**Is there a fix for CVE-2026-22226?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-22226 attacked?** It is attacked over the network or from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-22226?** Check whether you run TP-Link Archer AX73, TP-Link Archer Be230 or TP-Link Archer Be230 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability (CWE-78) exists in the VPN server configuration module of TP-Link Archer BE230 (v1.2) and Archer AX73 (v2) routers. The flaw resides in specific code paths within the VPN module that fail to properly neutralize special elements used in OS commands. An attacker must first authenticate as an administrator to reach the vulnerable component. Once authenticated, the attacker can inject malicious commands to gain full administrative control (root access) over the underlying operating system. This vulnerability is one of several distinct command injection issues identified in these products, each tracked under separate IDs. Patches are available in firmware versions 1.2.4 Build 20251218 for the BE230 and 1.3.1 Build 20260430 for the AX73.

## Affected products

- TP-Link Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420
- TP-Link Archer AX73 v2 < 1.3.1 Build 20260430

## Timeline

- 2026-02-02: disclosed
- 2026-02-02: advisory

## References

- [https://www.tp-link.com/en/support/download/archer-ax73/v2/](https://www.tp-link.com/en/support/download/archer-ax73/v2/)
- [https://www.tp-link.com/en/support/download/archer-be230/v1.20/](https://www.tp-link.com/en/support/download/archer-be230/v1.20/)
- [https://www.tp-link.com/sg/support/download/archer-be230/v1.20/](https://www.tp-link.com/sg/support/download/archer-be230/v1.20/)
- [https://www.tp-link.com/us/support/download/archer-ax73/v2/](https://www.tp-link.com/us/support/download/archer-ax73/v2/)
- [https://www.tp-link.com/us/support/download/archer-be230/v1.20/](https://www.tp-link.com/us/support/download/archer-be230/v1.20/)
- [https://www.tp-link.com/us/support/faq/4935/](https://www.tp-link.com/us/support/faq/4935/)

## Related threats

- [TP-Link Archer BE230 and BE3600 OS command injection in VPN module](https://junglewise.ai/threats/cve-2026-22223-tp-link-archer-be230-and-be3600-os-command-injection-in-vpn)
- [An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and Archer AXE75 v2 (web modules) allows adjacent…](https://junglewise.ai/threats/cve-2026-22222-an-os-command-injection-vulnerability-in-tp-link-archer-be230-v1)
- [TP-Link Archer BE230 and BE3600 OS command injection](https://junglewise.ai/threats/cve-2026-22221-tp-link-archer-be230-and-be3600-os-command-injection)
- [TP-Link Archer Routers OS command injection in VPN modules](https://junglewise.ai/threats/cve-2026-0631-tp-link-archer-routers-os-command-injection-in-vpn-modules)