# CVE-2026-77966: Ebyte NE2-D11 privilege escalation via missing authorization

Source: https://junglewise.ai/threats/cve-2026-77966-ebyte-ne2-d11-privilege-escalation-via-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77966 · Severity: high · CVSS 8.8 · Published 2026-08-31

The Ebyte NE2-D11 is a network gateway device used in industrial and energy infrastructure to manage critical communications and configurations. A low-privileged authenticated user can bypass authorization controls to access administrative functions, modify security settings, and compromise the integrity and availability of the device and the networks it protects.

Technologies: [Ebyte NE2-D11](https://junglewise.ai/threats/technologies/ne2-d11). Vendors: [Ebyte](https://junglewise.ai/threats/vendors/ebyte).

## Quick answers

**Is CVE-2026-77966 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77966 being exploited in the wild.

**How severe is CVE-2026-77966?** High severity, with a CVSS score of 8.8, published 31 August 2026.

**Which products and versions are affected?** Ebyte NE2-D11 Firmware FW-9167-0-11.

**Is there a fix for CVE-2026-77966?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-77966 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-77966?** Check whether you run Ebyte NE2-D11 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability stems from insufficient separation of privileged and unprivileged management functions in the NE2-D11 web interface. A low-privileged authenticated attacker can access security-sensitive configuration functions without proper authorization checks, potentially modifying device settings that affect confidentiality, integrity, and availability. The affected firmware version is FW-9167-0-11. The attack requires valid authentication credentials but no additional user interaction or elevated privilege level. Ebyte acknowledged the issues and indicated patch development, but has not provided status or availability details. CVSS 3.1 score is 8.8 (high severity).

## Affected products

- Ebyte NE2-D11 Firmware FW-9167-0-11

## Timeline

- 2026-08-25: disclosed
- 2026-08-31: advisory

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-06.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-06.json)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06](https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06)

## Related threats

- [Ebyte NE2-D11 credentials exposure in configuration export](https://junglewise.ai/threats/cve-2026-77975-ebyte-ne2-d11-credentials-exposure-in-configuration-export)
- [Ebyte NE2-D11 weak authentication hashing](https://junglewise.ai/threats/cve-2026-76133-ebyte-ne2-d11-weak-authentication-hashing)
- [Ebyte NE2-D11 missing authentication in management interface](https://junglewise.ai/threats/cve-2026-73819-ebyte-ne2-d11-missing-authentication-in-management-interface)
- [Ebyte NE2-D11 authentication bypass in configuration utility](https://junglewise.ai/threats/cve-2026-77977-ebyte-ne2-d11-authentication-bypass-in-configuration-utility)
- [Ebyte NE2-D11 authentication bypass via client-side token manipulation](https://junglewise.ai/threats/cve-2026-76945-ebyte-ne2-d11-authentication-bypass-via-client-side-token)