Is CVE-2026-72840 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-72840 being exploited in the wild.

How severe is CVE-2026-72840?

High severity, with a CVSS score of 8.8, published 13 August 2026.

Which products and versions are affected?

OpenWrt LuCI all versions from 2020-04-09 onwards, including 25.12.4.

Is there a fix for CVE-2026-72840?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-72840 attacked?

It is attacked over the network.

Am I affected by CVE-2026-72840?

Check whether you run OpenWrt LuCI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-72840: OpenWrt LuCI mount configuration ACL permission escalation

CVE-2026-72840 · Severity: high · CVSS 8.8 · Published 2026-08-13

OpenWrt LuCI is a web-based administration interface for OpenWrt routers. A misconfigured access control list (ACL) in the mount management module accidentally grants ordinary users the ability to write to the root user's cron job file, allowing them to execute arbitrary commands with administrative privileges. An attacker with any valid LuCI account can exploit this within minutes to gain full control of the router.

Technologies: OpenWrt LuCI. Vendors: OpenWrt.

Quick answers

Is CVE-2026-72840 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-72840 being exploited in the wild.
How severe is CVE-2026-72840?: High severity, with a CVSS score of 8.8, published 13 August 2026.
Which products and versions are affected?: OpenWrt LuCI all versions from 2020-04-09 onwards, including 25.12.4.
Is there a fix for CVE-2026-72840?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-72840 attacked?: It is attacked over the network.
Am I affected by CVE-2026-72840?: Check whether you run OpenWrt LuCI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a privilege escalation caused by an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root. The root cause is a copy-paste error during ACL reorganization in 2020; the /etc/crontabs/root write entry was intended only for the luci-mod-system-cron group but was duplicated into the luci-mod-system-mounts group, which is designed solely for filesystem mount management. An authenticated user with only the mount-configuration ACL permission can abuse the ubus file.write method to append arbitrary cron entries to /etc/crontabs/root. Since busybox crond is enabled and running by default, the injected cron jobs are executed as root within one minute. The attack requires only network access and valid LuCI credentials; no additional code execution primitives are needed. The vulnerability has affected all OpenWrt releases since April 2020, including version 25.12.4, with no patch released at the time of disclosure.

Affected products

OpenWrt LuCI all versions from 2020-04-09 onwards, including 25.12.4

Timeline

2026-08-13: disclosed
2020-04-09: other: Vulnerability introduced by commit c099344013 in 2020-04-09

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.