Is CVE-2026-9044 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9044 being exploited in the wild.

How severe is CVE-2026-9044?

Informational severity, with a CVSS score of 8.5, published 31 July 2026.

Which products and versions are affected?

TP-Link Archer AXE75 Before 1.5.6 Build 20260623.

Is there a fix for CVE-2026-9044?

A patch was published on 2026-06-23: Fixed firmware version 1.5.6 Build 20260623 was released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9044 attacked?

It is attacked from the adjacent network, in an operating system.

Am I affected by CVE-2026-9044?

Check whether you run TP-Link Archer AXE75 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9044: TP-Link Archer AXE75 OS command injection in VPN module

CVE-2026-9044 · Severity: info · CVSS 8.5 · Published 2026-07-31

A security vulnerability exists in the TP-Link Archer AXE75 V1 router, a device used to provide high-speed Wi-Fi and network connectivity. An attacker with administrative access to the router's management interface could take complete control of the device by uploading a malicious VPN configuration file. If exploited, this could allow an attacker to intercept network traffic, disable security features, or disrupt internet service for all connected users.

Vendors: TP-Link.

Quick answers

Is CVE-2026-9044 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9044 being exploited in the wild.
How severe is CVE-2026-9044?: Informational severity, with a CVSS score of 8.5, published 31 July 2026.
Which products and versions are affected?: TP-Link Archer AXE75 Before 1.5.6 Build 20260623.
Is there a fix for CVE-2026-9044?: A patch was published on 2026-06-23: Fixed firmware version 1.5.6 Build 20260623 was released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9044 attacked?: It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2026-9044?: Check whether you run TP-Link Archer AXE75 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists in the OpenVPN module of TP-Link Archer AXE75 V1 routers. The flaw is caused by improper filtering of special characters within VPN client configuration files during the import process. An adjacent attacker with high privileges (authenticated) can exploit this by uploading a specially crafted configuration file to execute arbitrary system commands. Successful exploitation grants full control over the underlying operating system. TP-Link has released firmware version 1.5.6 Build 20260623 to address this issue.

Affected products

TP-Link Archer AXE75 V1 Before 1.5.6 Build 20260623

Timeline

2026-07-31: advisory: TP-Link published the security advisory and NVD record.
2026-06-23: patched: Fixed firmware version 1.5.6 Build 20260623 was released.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.