Is CVE-2026-59764 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59764 being exploited in the wild.

How severe is CVE-2026-59764?

High severity, with a CVSS score of 7.2, published 28 July 2026.

Which products and versions are affected?

Elecom WRC-X3000GS3-B v1.06 and earlier; Elecom WRC-X3000GS3A-B v1.06 and earlier.

Is there a fix for CVE-2026-59764?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-59764 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-59764?

Check whether you run Elecom WRC-X3000GS3-B or Elecom WRC-X3000GS3A-B at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59764: ELECOM Wireless Routers OS command injection in WebUI

CVE-2026-59764 · Severity: high · CVSS 7.2 · Published 2026-07-28

ELECOM wireless routers and access points contain a security flaw in their web management interface. An attacker who has gained administrative login credentials can exploit this to take full control of the device by executing unauthorized system commands. This could lead to a complete compromise of the network traffic passing through the device or a total service outage.

Vendors: Elecom.

Quick answers

Is CVE-2026-59764 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59764 being exploited in the wild.
How severe is CVE-2026-59764?: High severity, with a CVSS score of 7.2, published 28 July 2026.
Which products and versions are affected?: Elecom WRC-X3000GS3-B v1.06 and earlier; Elecom WRC-X3000GS3A-B v1.06 and earlier.
Is there a fix for CVE-2026-59764?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-59764 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-59764?: Check whether you run Elecom WRC-X3000GS3-B or Elecom WRC-X3000GS3A-B at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists in the WebUI of specific ELECOM wireless LAN routers and access points. The flaw is located within the web management interface, specifically affecting the 'Restore Settings' functionality in related models. An attacker with high-level privileges (administrative access) can send specially crafted requests to the device to execute arbitrary OS commands. This allows for full system compromise, including data interception or persistent access. Users are advised to update to the latest firmware versions provided by the vendor to mitigate this risk.

Affected products

ELECOM WRC-X3000GS3-B v1.06 and earlier
ELECOM WRC-X3000GS3A-B v1.06 and earlier

Timeline

2026-07-28: advisory: JPCERT/CC and ELECOM published advisories.
2026-07-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.