Is CVE-2026-76852 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76852 being exploited in the wild.

How severe is CVE-2026-76852?

High severity, with a CVSS score of 8.8, published 15 September 2026.

Is there a fix for CVE-2026-76852?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-76852 attacked?

It is attacked over the network.

Am I affected by CVE-2026-76852?

Check whether you run Netcore NR268 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76852: Netcore NR268 firmware integrity verification bypass in mtd_write

CVE-2026-76852 · Severity: high · CVSS 8.8 · Published 2026-09-15

The Netcore NR268 is a network router used in residential and small business deployments. A flaw in its firmware update mechanism allows attackers to bypass signature validation and install malicious firmware images. This could lead to complete compromise of the router, enabling attackers to intercept network traffic, steal credentials, deploy ransomware, or use the device as a foothold for attacking connected networks.

Technologies: Netcore NR268. Vendors: Netcore.

Quick answers

Is CVE-2026-76852 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76852 being exploited in the wild.
How severe is CVE-2026-76852?: High severity, with a CVSS score of 8.8, published 15 September 2026.
Which products and versions are affected?: Netcore NR268 1.7.121109.
Is there a fix for CVE-2026-76852?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-76852 attacked?: It is attacked over the network.
Am I affected by CVE-2026-76852?: Check whether you run Netcore NR268 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper integrity verification flaw (CWE-354) in the mtd_write component of the Netcore NR268 firmware version 1.7.121109. Attackers can exploit the put_file.cgi endpoint and check_image_uuid.c functions to forge firmware authenticity checks and bypass signature validation. The vulnerability requires network access and authentication (login credentials) to exploit, but allows an authenticated attacker to load unauthorized firmware images onto the device. This results in complete device compromise. No patch information is currently available in the advisory.

Affected products

Netcore NR268 1.7.121109

Timeline

2026-09-04: disclosed
2026-09-15: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.