Is CVE-2026-8272 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8272 being exploited in the wild.

How severe is CVE-2026-8272?

Medium severity, with a CVSS score of 4.7, published 11 May 2026.

Which products and versions are affected?

D-Link DNS-320 ShareCenter NAS 2.06B01.

Is there a fix for CVE-2026-8272?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8272 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-8272?

Check whether you run D-Link DNS-320 ShareCenter NAS, Dlink Dns-320 or Dlink Dns-320 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8272: D-Link DNS-320 OS command injection in webfile_mgr.cgi

CVE-2026-8272 · Severity: medium · CVSS 4.7 · Published 2026-05-11

A security vulnerability exists in D-Link DNS-320 ShareCenter storage devices, which are used to manage and store files on a network. An attacker can exploit this flaw to take complete control of the device by injecting malicious commands through file management features like deleting or renaming files. This could lead to the theft of sensitive data, loss of files, or the device being used as a foothold to attack other systems on the corporate network.

Technologies: D-Link DNS-320 ShareCenter NAS, Dlink Dns-320, Dlink Dns-320 Firmware. Vendors: D-Link, Dlink.

Quick answers

Is CVE-2026-8272 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8272 being exploited in the wild.
How severe is CVE-2026-8272?: Medium severity, with a CVSS score of 4.7, published 11 May 2026.
Which products and versions are affected?: D-Link DNS-320 ShareCenter NAS 2.06B01.
Is there a fix for CVE-2026-8272?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8272 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-8272?: Check whether you run D-Link DNS-320 ShareCenter NAS, Dlink Dns-320 or Dlink Dns-320 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Multiple OS command injection vulnerabilities exist in the /cgi-bin/webfile_mgr.cgi component of D-Link DNS-320 firmware version 2.06B01. The vulnerability is rooted in several functions (including cgi_del, cgi_rename, cgi_copy, cgi_move, cgi_chmod, and cgi_chown) that read path and filename parameters via cgiFormString() and improperly embed them into shell commands using sprintf() before passing them to the system() function. A remote attacker with low-privileged access can exploit this by sending a crafted POST request containing shell metacharacters (e.g., semicolons) in the 'path' parameter. Successful exploitation allows for arbitrary command execution with the privileges of the web server. While some sources report a lower CVSS, the technical analysis confirms a high-impact exploit path with public proof-of-concept code available.

Affected products

D-Link DNS-320 ShareCenter NAS (Rev.A) 2.06B01

Timeline

2026-05-11: disclosed: Vulnerability published and CVE-2026-8272 assigned.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.