Is CVE-2026-90822 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90822 being exploited in the wild.

How severe is CVE-2026-90822?

Critical severity, with a CVSS score of 9.8, published 17 September 2026.

Which products and versions are affected?

Fatpipe IPVPN 10.1.2r60p100; Fatpipe MPVPN 10.1.2r60p100; Fatpipe WARP 10.1.2r60p100.

Is there a fix for CVE-2026-90822?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90822 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-90822?

Check whether you run Fatpipe IPVPN, Fatpipe MPVPN or Fatpipe WARP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90822: FatPipe MPVPN, WARP, and IPVPN OS command injection in xtremed

CVE-2026-90822 · Severity: critical · CVSS 9.8 · Published 2026-09-17

FatPipe MPVPN, WARP, and IPVPN are WAN optimization and SD-WAN appliances used to manage multi-site network connectivity and performance. A critical unauthenticated remote code execution vulnerability in firmware version 10.1.2r60p100 allows attackers who reach the management interface to inject arbitrary shell commands that execute with root privileges, potentially leading to complete compromise of the appliance and the networks it protects.

Technologies: Fatpipe IPVPN, Fatpipe WARP. Vendors: Fatpipe.

Quick answers

Is CVE-2026-90822 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90822 being exploited in the wild.
How severe is CVE-2026-90822?: Critical severity, with a CVSS score of 9.8, published 17 September 2026.
Which products and versions are affected?: Fatpipe IPVPN 10.1.2r60p100; Fatpipe MPVPN 10.1.2r60p100; Fatpipe WARP 10.1.2r60p100.
Is there a fix for CVE-2026-90822?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90822 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-90822?: Check whether you run Fatpipe IPVPN, Fatpipe MPVPN or Fatpipe WARP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an OS command injection flaw in the xtremed daemon, accessible via the AuthFormServlet endpoint on the management interface. An unauthenticated remote attacker can submit crafted input that is processed by a shell without proper sanitization, allowing arbitrary command execution as root. The management interface is disabled by default but becomes reachable once explicitly enabled by administrators. Exploitation requires network access to the management interface; however, no authentication is required. FatPipe recommends restricting management access to trusted networks using firewall ACLs and upgrading from the end-of-life firmware version 10.1.2r60p100 to a current supported release.

Affected products

FatPipe MPVPN 10.1.2r60p100
FatPipe WARP 10.1.2r60p100
FatPipe IPVPN 10.1.2r60p100

Timeline

2026-09-17: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.