Quick answers
- Is CVE-2026-3088 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-3088 being exploited in the wild.
- How severe is CVE-2026-3088?
- Informational severity, with a CVSS score of 4.9, published 9 June 2026.
- Which products and versions are affected?
- Netgear RBR860; Netgear RBRE950; Netgear RBRE960; Netgear RBS860; and 2 more.
- Is there a fix for CVE-2026-3088?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-3088 attacked?
- It is attacked from the adjacent network, in a network appliance.
- Am I affected by CVE-2026-3088?
- Check whether you run NETGEAR RBR860, NETGEAR RBRE950, NETGEAR RBRE960 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A denial-of-service vulnerability exists in multiple Netgear router models (RBR860, RBRE950, RBRE960, RBS860, RBSE950, RBSE960) due to an out-of-bounds write (CWE-787). An unauthenticated attacker located on the same local network (adjacent) can exploit this by sending specially crafted requests to the device. Successful exploitation leads to a crash or hang, rendering the router unavailable. The vulnerability is tracked as CVE-2026-3088 and has been assigned a CVSS 4.0 score of 4.9 by the vendor.
Affected products
- Netgear RBR860
- Netgear RBRE950
- Netgear RBRE960
- Netgear RBS860
- Netgear RBSE950
- Netgear RBSE960
Timeline
- 2026-06-09: disclosed: CVE published to NVD dataset