Is CVE-2026-90881 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90881 being exploited in the wild.

How severe is CVE-2026-90881?

Medium severity, with a CVSS score of 5.3, published 15 September 2026.

Is there a fix for CVE-2026-90881?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90881 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-90881?

Check whether you run D-Link DIR-882 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90881: D-Link DIR-882 information disclosure in CGI binary

CVE-2026-90881 · Severity: medium · CVSS 5.3 · Published 2026-09-15

D-Link DIR-882 is a wireless router used in home and office networks. A vulnerability in the router's web management interface (specifically the /HNAP1/dllog.cgi file) allows an attacker to remotely extract sensitive information from the device without requiring authentication. An attacker could potentially gain access to configuration data, logs, or other confidential information stored on the router.

Vendors: D-Link.

Quick answers

Is CVE-2026-90881 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90881 being exploited in the wild.
How severe is CVE-2026-90881?: Medium severity, with a CVSS score of 5.3, published 15 September 2026.
Which products and versions are affected?: D-Link DIR-882 up to 20260814.
Is there a fix for CVE-2026-90881?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90881 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-90881?: Check whether you run D-Link DIR-882 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the main function of the CGI binary at /HNAP1/dllog.cgi in D-Link DIR-882 firmware up to version 20260814. The affected component fails to properly validate or restrict access to sensitive data exposed through the web interface. The vulnerability is remotely exploitable over the network without authentication or user interaction required. An attacker can send a crafted request to the dllog.cgi endpoint to manipulate the application logic and retrieve sensitive information such as logs, configuration, or other protected data. Public exploit code is available, increasing the likelihood of active exploitation.

Affected products

D-Link DIR-882 up to 20260814

Timeline

2026-09-15: disclosed
other: Public exploit code available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.