Is CVE-2026-86299 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86299 being exploited in the wild.

How severe is CVE-2026-86299?

Critical severity, with a CVSS score of 9.9, published 7 September 2026.

Is there a fix for CVE-2026-86299?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86299 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-86299?

Check whether you run Linksys Re7000 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86299: Linksys RE7000 OS command injection in PingTest handler

CVE-2026-86299 · Severity: critical · CVSS 9.9 · Published 2026-09-07

The Linksys RE7000 WiFi range extender contains a remote command injection vulnerability in its web administration interface. An attacker can exploit this flaw to execute arbitrary system commands on the device without authentication, leading to complete device compromise, credential theft, or use as a pivot point into the network.

Technologies: Linksys Re7000. Vendors: Linksys.

Quick answers

Is CVE-2026-86299 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86299 being exploited in the wild.
How severe is CVE-2026-86299?: Critical severity, with a CVSS score of 9.9, published 7 September 2026.
Which products and versions are affected?: Linksys Re7000 2.0.15.
Is there a fix for CVE-2026-86299?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86299 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-86299?: Check whether you run Linksys Re7000 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an OS command injection flaw in the PingTest handler of Linksys RE7000 firmware version 2.0.15, accessible via the /cgi-bin/json.cgi?PingTest endpoint. The function platform_event_pingTest fails to properly sanitize user-supplied parameters (pingTestIp, pingTestPktSize, pingTestTimes) before passing them to system command execution. An unauthenticated remote attacker can inject arbitrary OS commands through these parameters to achieve remote code execution with device privileges. The exploit is publicly available, increasing the risk of active exploitation.

Affected products

Linksys RE7000 2.0.15

Timeline

2026-09-07: disclosed: Vulnerability disclosed and exploit published
2026-09-07: other: Exploit confirmed public and may be used in the wild

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.