# CVE-2026-89409: Silicon Labs Z-Wave SDK unvalidated message handling in node removal

Source: https://junglewise.ai/threats/cve-2026-89409-in-z-wave-sdk-8-1-1-and-earlier-for-700-800-series-devices-and-6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-89409 · Severity: info · Published 2026-10-22

Silicon Labs' Z-Wave SDK powers wireless mesh networks used in smart home and IoT devices. A vulnerability in how the SDK validates certain network messages allows an attacker already on the network to remotely delete authorized devices, disrupting network functionality and IoT operations. The attacker must be a device that has already joined the network.

Vendors: [Silicon Labs](https://junglewise.ai/threats/vendors/silicon-labs).

## Quick answers

**Is CVE-2026-89409 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89409 being exploited in the wild.

**How severe is CVE-2026-89409?** Informational severity, published 22 October 2026.

**Which products and versions are affected?** Silicon Labs Z-Wave SDK 8.1.1 and earlier (700/800 series), 6.85.02 and earlier (500 series); Silicon Labs Z-Wave SDK 7.21.x 7.21.x and earlier.

**Is there a fix for CVE-2026-89409?** Yes: fixed in Z-Wave SDK 8.1.2 or later; Z-Wave 500 SDK 6.85.03 or later; SiSDK 2026.6.1 and earlier requires fix pending for 700 series. Until then: A fix for Z-Wave 700 Series devices is not available at this time. Restrict network access and monitor for unauthorized device additions to the mesh network. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-89409 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-89409?** Check whether you run Silicon Labs Z-Wave SDK or Silicon Labs Z-Wave SDK 7.21.x at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Z-Wave SDK 8.1.2 or later; Z-Wave 500 SDK 6.85.03 or later; SiSDK 2026.6.1 and earlier requires fix pending for 700 series

A fix for Z-Wave 700 Series devices is not available at this time. Restrict network access and monitor for unauthorized device additions to the mesh network.

## Technical details

The ZWAVE_CMD_NODES_EXIST handler lacks validation checks that should restrict node deletion to controllers during automatic updates with proper SUC ID authorization. An attacker with network access can send a crafted message to remove nodes from the mesh. The vulnerability requires the attacker to be an already-joined network member and affects Z-Wave SDK versions 8.1.1 and earlier (700/800 series) and 6.85.02 and earlier (500 series).

## Affected products

- Silicon Labs Z-Wave SDK 8.1.1 and earlier (700/800 series), 6.85.02 and earlier (500 series)
- Silicon Labs Z-Wave SDK 7.21.x 7.21.x and earlier

## Timeline

- 2026-10-22: disclosed

## References

- [https://github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/500-599/A-00000591.md](https://github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/500-599/A-00000591.md)

## Related threats

- [Silicon Labs Z-Wave SDK out-of-bounds read in NCP Serial API](https://junglewise.ai/threats/cve-2026-89410-in-z-wave-sdk-8-1-1-and-earlier-a-malformed-ncp-spi-command-can)