CVE-2026-9044: An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary comma
An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper filtering of special characters.
Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-9044
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-90440.97% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 59% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-9044 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for An OS command
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- criticalCVE-2026-67208: Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticate…nvd · 2026-07-30
- mediumGHSA-xc5w-4v5w-7x65: OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Chec…ghsa · 2026-07-30
- highCVE-2026-44098: This vulnerability allows an unauthenticated remote attacker with control over the OCPP backen…nvd · 2026-07-30
- highCVE-2026-61376: ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerab…nvd · 2026-07-28
- highCVE-2026-59764: ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerab…nvd · 2026-07-28
- criticalCVE-2026-48030: Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before…nvd · 2026-07-27
More from NVD Recent CVEs
- mediumCVE-2026-67355: guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the …2026-08-01
- mediumCVE-2026-67354: guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in Re…2026-08-01
- mediumCVE-2026-67353: guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the Cook…2026-08-01
- highCVE-2026-67352: luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_…2026-08-01
- mediumCVE-2026-67344: ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYP…2026-08-01