# CVE-2026-90823: FatPipe MPVPN WARP IPVPN stack buffer overflow in auth_user_pass

Source: https://junglewise.ai/threats/cve-2026-90823-fatpipe-mpvpn-warp-ipvpn-stack-buffer-overflow-in-auth-user-pass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90823 · Severity: critical · CVSS 9.8 · Published 2026-09-17

FatPipe's MPVPN, WARP, and IPVPN appliances are WAN optimization and VPN devices used to manage multi-site network connectivity. An unauthenticated attacker with network access to the management interface (which is disabled by default) can send a crafted request to trigger a buffer overflow in the authentication service, potentially gaining complete control of the appliance. This impacts network availability and security across connected sites.

Technologies: [Fatpipe IPVPN](https://junglewise.ai/threats/technologies/ipvpn), [Fatpipe WARP](https://junglewise.ai/threats/technologies/warp). Vendors: [Fatpipe](https://junglewise.ai/threats/vendors/fatpipe).

## Quick answers

**Is CVE-2026-90823 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90823 being exploited in the wild.

**How severe is CVE-2026-90823?** Critical severity, with a CVSS score of 9.8, published 17 September 2026.

**Which products and versions are affected?** Fatpipe IPVPN 10.1.2r60p100; Fatpipe MPVPN 10.1.2r60p100; Fatpipe WARP 10.1.2r60p100.

**Is there a fix for CVE-2026-90823?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90823 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-90823?** Check whether you run Fatpipe IPVPN, Fatpipe MPVPN or Fatpipe WARP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in the /usr/sbin/auth_user_pass binary on affected appliances. The vulnerability is triggered when an unchecked copy operation writes attacker-controlled data into a fixed-size stack buffer, allowing stack corruption and arbitrary code execution as root. The attack vector is the management interface (typically disabled by default); an attacker must first gain network access to this interface through misconfiguration or network exposure. While no active exploitation in the wild has been reported, the 9.8 CVSS score reflects the severity—authentication is not required and code execution as root is achievable. FatPipe has marked firmware version 10.1.2r60p100 as end-of-life; customers must upgrade to supported releases for a patch.

## Affected products

- FatPipe MPVPN 10.1.2r60p100
- FatPipe WARP 10.1.2r60p100
- FatPipe IPVPN 10.1.2r60p100

## Timeline

- 2026-09-17: disclosed

## References

- [https://www.fatpipeinc.com/support/support](https://www.fatpipeinc.com/support/support)
- [https://www.securifera.com/advisories/](https://www.securifera.com/advisories/)

## Related threats

- [FatPipe MPVPN, WARP, and IPVPN OS command injection in xtremed](https://junglewise.ai/threats/cve-2026-90822-fatpipe-mpvpn-warp-and-ipvpn-os-command-injection-in-xtremed)
- [FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit](https://junglewise.ai/threats/cve-2021-27860-fatpipe-warp-ipvpn-and-mpvpn-configuration-upload-exploit)