Quick answers
- Is CVE-2026-76652 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-76652 being exploited in the wild.
- How severe is CVE-2026-76652?
- Informational severity, with a CVSS score of 0, published 10 September 2026.
- Which products and versions are affected?
- TP-Link Archer MR600 v2, v3, v5; TP-Link TL-MR6400 v8.
- Is there a fix for CVE-2026-76652?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-76652 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-76652?
- Check whether you run TP-Link Archer MR600 or TP-Link TL-MR6400 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is an authenticated directory traversal vulnerability in the file upload functionality caused by insufficient validation of user-supplied file paths. An authenticated remote attacker with access to the upload feature can craft a malicious file path using directory traversal sequences (e.g., "../") to write files outside the intended upload directory. The vulnerability affects Archer MR600 versions 2, 3, and 5, as well as TL-MR6400 version 8. Successful exploitation allows arbitrary file writing to unintended locations, potentially overwriting system files, though arbitrary code execution has not been demonstrated. The vulnerability requires prior authentication to the affected router's web interface.
Affected products
- TP-Link Archer MR600 v2, v3, v5
- TP-Link TL-MR6400 v8
Timeline
- 2026-09-10: disclosed