Is CVE-2026-86530 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86530 being exploited in the wild.

How severe is CVE-2026-86530?

High severity, with a CVSS score of 7.2, published 28 September 2026.

Which products and versions are affected?

Buffalo WEX-G300 prior to Ver.1.71; Buffalo WSR-300HP prior to Ver.2.55.

Is there a fix for CVE-2026-86530?

A patch was published on 2026-08-25: WSR-300HP firmware Ver.2.55 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86530 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-86530?

Check whether you run Buffalo WEX-G300 or Buffalo WSR-300HP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86530: BUFFALO Wi-Fi products OS command injection

CVE-2026-86530 · Severity: high · CVSS 7.2 · Published 2026-09-28

BUFFALO Wi-Fi routers and range extenders use insecure web form handling that allows an authenticated administrative user to inject arbitrary operating system commands. An attacker with admin access can craft a malicious HTTP request to execute commands with full system privileges, potentially compromising the entire network device and any networks it serves.

Vendors: Buffalo.

Quick answers

Is CVE-2026-86530 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86530 being exploited in the wild.
How severe is CVE-2026-86530?: High severity, with a CVSS score of 7.2, published 28 September 2026.
Which products and versions are affected?: Buffalo WEX-G300 prior to Ver.1.71; Buffalo WSR-300HP prior to Ver.2.55.
Is there a fix for CVE-2026-86530?: A patch was published on 2026-08-25: WSR-300HP firmware Ver.2.55 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86530 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-86530?: Check whether you run Buffalo WEX-G300 or Buffalo WSR-300HP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists in the web configuration interface where user-supplied form input is improperly sanitized before being assembled into system command strings. The vulnerability requires administrative authentication and network access to the web interface. Successful exploitation allows arbitrary OS command execution with system-level privileges; firmware updates are available.

Affected products

BUFFALO WSR-300HP prior to Ver.2.55
BUFFALO WEX-G300 prior to Ver.1.71

Timeline

2026-09-28: disclosed
2026-08-25: patched: WSR-300HP firmware Ver.2.55
2026-09-03: patched: WEX-G300 firmware Ver.1.71

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.