Is CVE-2026-71912 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-71912 being exploited in the wild.

How severe is CVE-2026-71912?

High severity, with a CVSS score of 7.2, published 24 August 2026.

Which products and versions are affected?

DrayTek VigorAP 1060C < 1.4.12; DrayTek VigorAP 903 < 1.4.22; DrayTek VigorAP 906 < 1.4.13; DrayTek VigorAP 912C < 1.4.15; and 2 more.

Is there a fix for CVE-2026-71912?

A patch was published on 2026-08-24: Patched firmware releases available (1.4.11–1.4.22 depending on model) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-71912 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-71912?

Check whether you run DrayTek VigorAP 1060C, DrayTek VigorAP 903, DrayTek VigorAP 906 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71912: DrayTek VigorAP buffer overflow in apautotest

Q: Is there a fix for CVE-2026-71912?

A patch was published on 2026-08-24: Patched firmware releases available (1.4.11–1.4.22 depending on model) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-71912 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-71912?

Check whether you run DrayTek VigorAP 1060C, DrayTek VigorAP 903, DrayTek VigorAP 906 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71912 · Severity: high · CVSS 7.2 · Published 2026-08-24

DrayTek VigorAP is a wireless access point used in enterprise networks to provide secure connectivity. The apautotest function contains a buffer overflow vulnerability that allows an authenticated administrator to trigger a denial of service condition or potentially execute arbitrary code on the device through specially crafted input. Successful exploitation requires valid administrative credentials and access to the web management interface.

Technologies: DrayTek VigorAP 1060C, DrayTek VigorAP 903, DrayTek VigorAP 906, DrayTek VigorAP 912C, DrayTek VigorAP 918R, DrayTek VigorAP 960C. Vendors: DrayTek.

Quick answers

Is CVE-2026-71912 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-71912 being exploited in the wild.
How severe is CVE-2026-71912?: High severity, with a CVSS score of 7.2, published 24 August 2026.
Which products and versions are affected?: DrayTek VigorAP 1060C < 1.4.12; DrayTek VigorAP 903 < 1.4.22; DrayTek VigorAP 906 < 1.4.13; DrayTek VigorAP 912C < 1.4.15; and 2 more.
Is there a fix for CVE-2026-71912?: A patch was published on 2026-08-24: Patched firmware releases available (1.4.11–1.4.22 depending on model) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71912 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-71912?: Check whether you run DrayTek VigorAP 1060C, DrayTek VigorAP 903, DrayTek VigorAP 906 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a classic buffer overflow (CWE-120) in the apautotest function caused by missing length checks during memory copy operations involving the CMD6 field. A remote attacker with valid administrative credentials can supply crafted input to trigger the overflow, potentially leading to arbitrary code execution or denial of service. The attack vector is network-based but requires high privilege (authenticated admin access) to the device's web management interface. Patches are available in firmware versions 1.4.11–1.4.22 depending on the specific VigorAP model.

Affected products

DrayTek VigorAP 918R < 1.4.11
DrayTek VigorAP 960C < 1.4.12
DrayTek VigorAP 1060C < 1.4.12
DrayTek VigorAP 906 < 1.4.13
DrayTek VigorAP 912C < 1.4.15
DrayTek VigorAP 903 < 1.4.22

Timeline

2026-08-24: disclosed: Security advisory published
2026-08-24: patched: Patched firmware releases available (1.4.11–1.4.22 depending on model)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.