Is CVE-2026-76854 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76854 being exploited in the wild.

How severe is CVE-2026-76854?

Medium severity, with a CVSS score of 6.5, published 15 September 2026.

Is there a fix for CVE-2026-76854?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-76854 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-76854?

Check whether you run Netcore NR255-V at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76854: Netcore NR255-V sensitive information disclosure in l7_web_auth_user_show.cgi

CVE-2026-76854 · Severity: medium · CVSS 6.5 · Published 2026-09-15

The Netcore NR255-V is a wireless router used in enterprise and residential networks. A vulnerability in its captive-portal authentication component exposes user credentials stored in the device, allowing attackers who access the web interface to retrieve login information for network users. This compromises the security of authenticated network access and could enable unauthorized access to the network.

Technologies: Netcore NR255-V. Vendors: Netcore.

Quick answers

Is CVE-2026-76854 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76854 being exploited in the wild.
How severe is CVE-2026-76854?: Medium severity, with a CVSS score of 6.5, published 15 September 2026.
Which products and versions are affected?: Netcore NR255-V 1.5.130703.
Is there a fix for CVE-2026-76854?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-76854 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-76854?: Check whether you run Netcore NR255-V at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a sensitive information disclosure flaw (CWE-522) in the l7_web_auth_user_show.cgi CGI script, which handles captive-portal user credential management. An authenticated attacker can query this web component to retrieve captive-portal user credentials in cleartext or weakly protected form. The attack vector is network-based and requires login credentials to the router's web interface. An attacker with administrative or authenticated access can extract credentials for all network users, compromising confidentiality of network authentication. No patch information is currently available in the advisory.

Affected products

Netcore NR255-V 1.5.130703

Timeline

2026-09-04: disclosed
2026-09-15: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.