NETGEAR router admin privilege escalation via input validation
CVE-2026-11738 Published on August 11, 2026

Insufficient input validation in certain NETGEAR Nighthawk routers allows administrators to tamper with the device.
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.

Vendor Advisory NVD

Vulnerability Analysis

Attack Vector:

ADJACENT

Attack Complexity:

LOW

Privileges Required:

HIGH

User Interaction:

NONE

Weakness Type

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Products Associated with CVE-2026-11738

Want to know whenever a new CVE is published for Netgear products? stack.watch will email you.

Netgear R7000

Netgear Raxe500

Netgear Rs700

Affected Versions

NETGEAR R7000:

Before * is affected.

NETGEAR RAXE500:

Before V1.2.14.114 is affected.

NETGEAR RS700:

Before V1.0.7.66 is affected.

Exploit Probability

EPSS

0.27%

Percentile

17.05%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.