Is CVE-2026-78860 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78860 being exploited in the wild.

How severe is CVE-2026-78860?

Informational severity, published 5 October 2026.

Which products and versions are affected?

Mercusys AC12 V2 ac12v2-up_2020-09-03 and prior.

How is CVE-2026-78860 attacked?

It is attacked with physical access, in a network appliance.

Am I affected by CVE-2026-78860?

Check whether you run Mercusys AC12 V2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78860: Mercusys AC12 V2 missing firmware encryption and secure boot

CVE-2026-78860 · Severity: info · Published 2026-10-05

Mercusys AC12 V2 wireless routers lack encryption on flash storage and secure boot verification, allowing attackers with physical access to extract sensitive credentials stored in plaintext or install persistent backdoors. An attacker can use specialized hardware tools to read or modify the firmware, gaining complete control of the device or obtaining Wi-Fi passwords and administrator credentials. This affects routers in physically accessible locations such as offices or shared facilities.

Technologies: Mercusys AC12 V2. Vendors: Mercusys.

Quick answers

Is CVE-2026-78860 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78860 being exploited in the wild.
How severe is CVE-2026-78860?: Informational severity, published 5 October 2026.
Which products and versions are affected?: Mercusys AC12 V2 ac12v2-up_2020-09-03 and prior.
Is there a fix for CVE-2026-78860?: No fixed version is recorded yet. Physically secure routing infrastructure in locked cabinets or restricted-access rooms to prevent unauthorized direct hardware interfacing. When decommissioning hardware, physically destroy the SPI flash chip to ensure legacy network credentials cannot be recovered via hardware dumping. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-78860 attacked?: It is attacked with physical access, in a network appliance.
Am I affected by CVE-2026-78860?: Check whether you run Mercusys AC12 V2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Physically secure routing infrastructure in locked cabinets or restricted-access rooms to prevent unauthorized direct hardware interfacing. When decommissioning hardware, physically destroy the SPI flash chip to ensure legacy network credentials cannot be recovered via hardware dumping.

Technical details

The Mercusys AC12 V2 stores all data including the bootloader, operating system, and configuration in unencrypted plaintext on a 2MB SPI flash chip, and lacks a hardware-enforced Secure Boot chain. An attacker with physical access can use an SPI flash programmer (such as CH341A) with a test clip to directly dump or modify the flash contents without authentication or user interaction. This enables extraction of plaintext Wi-Fi passphrases and ISP credentials, or injection of malicious firmware that executes with no integrity verification during boot.

Affected products

Mercusys AC12 V2 ac12v2-up_2020-09-03 and prior

Timeline

2026-10-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.