Is CVE-2026-76853 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76853 being exploited in the wild.

How severe is CVE-2026-76853?

High severity, with a CVSS score of 8.1, published 15 September 2026.

Is there a fix for CVE-2026-76853?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-76853 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-76853?

Check whether you run Netcore NR268 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76853: Netcore NR268 security check bypass in parame_put_file.cgi

CVE-2026-76853 · Severity: high · CVSS 8.1 · Published 2026-09-15

The Netcore NR268 is a network router used to manage and secure internet connectivity in homes and small offices. A flaw in its firmware restore functionality allows authenticated attackers to bypass security checks and restore malicious configuration files, potentially compromising the entire network and all connected devices.

Technologies: Netcore NR268. Vendors: Netcore.

Quick answers

Is CVE-2026-76853 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76853 being exploited in the wild.
How severe is CVE-2026-76853?: High severity, with a CVSS score of 8.1, published 15 September 2026.
Which products and versions are affected?: Netcore NR268 1.7.121109.
Is there a fix for CVE-2026-76853?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-76853 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-76853?: Check whether you run Netcore NR268 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a security check bypass (CWE-353: Missing Support for Integrity Check) in the parame_put_file.cgi component, specifically in the prefix validation logic within put_parame_file_cgi.c. An authenticated attacker can craft a restore archive that bypasses the prefix check, allowing them to restore arbitrary configuration files to the device. The vulnerability requires authentication (PR:L) and network access; exploitation does not require user interaction. A successful attack enables an attacker to modify device configuration with high integrity impact (VI:H) and availability impact (VA:H), potentially leading to complete device compromise.

Affected products

Netcore NR268 1.7.121109

Timeline

2026-09-15: disclosed
2026-09-04: advisory: Public reference published on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.