Back Redpacketsecurity CVE Alert: CVE-2026-86300 – Tenda
A flaw has been found in Tenda AC9 15.03.05.14. This impacts the function R7WebsSecurityHandler of the component Web Management. This manipulation causes improper authentication. The attack may be initiated remotely. The exploit has been published and may be used.
**Risk verdict:** High practical risk for internet-reachable management interfaces, requiring urgent remediation where administration is exposed beyond a trusted network.
Authentication bypass can give an unauthorised party administrative influence over a boundary device, enabling configuration tampering, traffic interception, credential harvesting, DNS manipulation or service disruption. Public exploit availability materially increases the likelihood of opportunistic scanning, even though there is no supplied evidence of active exploitation, KEV listing or a high EPSS probability.
Most likely attack path
An attacker can reach the target remotely with low complexity, without credentials or user interaction, by sending crafted requests to the web-management service. Scope is unchanged, so direct impact is concentrated on the router, but control of that device can support follow-on access through altered DNS, port forwarding, firewall rules or firmware-related settings.
Small offices, workers and unmanaged branch sites using the device as an internet edge router are most vulnerable. Risk is highest where administration is enabled on the WAN, exposed through port forwarding, or reachable from untrusted wireless or guest networks.
Review web-management access logs for unauthorised requests, repeated probing or unusual administrative actions.
Alert on configuration changes to DNS, firewall, NAT, remote administration and wireless settings.
Compare device configuration and firmware integrity against approved baselines.
Investigate unexplained outbound traffic or redirects originating from affected routers.
Mitigation and prioritisation
Apply the vendor’s corrective firmware or replace unsupported hardware; treat patching as urgent.
Disable WAN-side administration and restrict management to a dedicated, trusted network.
Block unsolicited access to management ports at upstream firewalls and monitor attempted connections.
Preserve configurations before maintenance and validate DNS, routing and access controls afterwards.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
