Is CVE-2026-82690 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82690 being exploited in the wild.

How severe is CVE-2026-82690?

Critical severity, with a CVSS score of 9.1, published 31 August 2026.

Which products and versions are affected?

D-Link DNS-327L up to 20260717; D-Link DNS-340L up to 20260717.

Is there a fix for CVE-2026-82690?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82690 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-82690?

Check whether you run D-Link DNS-327L or D-Link DNS-340L at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82690: D-Link DNS-327L and DNS-340L OS command injection in ve_mgr.cgi

CVE-2026-82690 · Severity: critical · CVSS 9.1 · Published 2026-08-31

D-Link DNS-327L and DNS-340L are network storage devices used in small offices and homes. A remote attacker can inject arbitrary operating system commands through a vulnerable web interface, allowing complete takeover of the device without authentication. This could compromise stored data, disrupt network operations, or serve as a foothold for further attacks.

Technologies: D-Link DNS-327L, D-Link DNS-340L. Vendors: D-Link.

Quick answers

Is CVE-2026-82690 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82690 being exploited in the wild.
How severe is CVE-2026-82690?: Critical severity, with a CVSS score of 9.1, published 31 August 2026.
Which products and versions are affected?: D-Link DNS-327L up to 20260717; D-Link DNS-340L up to 20260717.
Is there a fix for CVE-2026-82690?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82690 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-82690?: Check whether you run D-Link DNS-327L or D-Link DNS-340L at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an OS command injection vulnerability in the /cgi-bin/ve_mgr.cgi web interface. The vulnerability exists in the handling of the "f_dev" parameter, which fails to properly sanitize user input before passing it to system commands. An attacker can exploit this flaw remotely without authentication by crafting a malicious request containing shell metacharacters in the f_dev argument. Successful exploitation allows arbitrary command execution with device privileges. Affected versions extend to at least 20260717; patch availability status is unclear.

Affected products

D-Link DNS-327L up to 20260717
D-Link DNS-340L up to 20260717

Timeline

2026-08-31: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.