Is CVE-2026-6837 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6837 being exploited in the wild.

How severe is CVE-2026-6837?

High severity, with a CVSS score of 7.2, published 4 August 2026.

Which products and versions are affected?

Zyxel WAX650S through 7.10(ABRM.4)C0.

Is there a fix for CVE-2026-6837?

A patch was published on 2026-08-04: Patches available in firmware 7.12 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6837 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-6837?

Check whether you run Zyxel WAX650S at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6837: Zyxel WAX650S command injection in export-cgi

CVE-2026-6837 · Severity: high · CVSS 7.2 · Published 2026-08-04

Zyxel WAX650S is a wireless access point used to provide network connectivity in enterprise and business environments. A post-authentication command injection flaw in the device's export-cgi program allows authenticated administrators to execute arbitrary operating system commands, potentially enabling unauthorized system takeover or data theft. This vulnerability requires administrator credentials to exploit but grants an attacker full control over the affected device.

Vendors: Zyxel.

Quick answers

Is CVE-2026-6837 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6837 being exploited in the wild.
How severe is CVE-2026-6837?: High severity, with a CVSS score of 7.2, published 4 August 2026.
Which products and versions are affected?: Zyxel WAX650S through 7.10(ABRM.4)C0.
Is there a fix for CVE-2026-6837?: A patch was published on 2026-08-04: Patches available in firmware 7.12 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6837 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-6837?: Check whether you run Zyxel WAX650S at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a post-authentication command injection flaw in the "export-cgi" CGI program. An authenticated attacker with administrator privileges can inject OS commands that are executed on the device. The vulnerability affects Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0. Attack requires valid administrator credentials to authenticate to the device. Successful exploitation allows an attacker to execute arbitrary OS commands with device privileges, potentially leading to full compromise. Patches are available in firmware version 7.12 and later.

Affected products

Zyxel WAX650S through 7.10(ABRM.4)C0

Timeline

2026-08-04: disclosed
2026-08-04: patched: Patches available in firmware 7.12 and later

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-improper-authentication-vulnerabilities-in-certain-aps-fwa7-and-security-routers-08-04-2026

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.