D Link Router Hit By Cvss 10 0 Flaw Exploitable Remotely Without Authentication

www.itsecuritynews.info • September 22, 2026

D-Link Systems has disclosed that it is investigating a critical security vulnerability in its DIR-822A router, tracked as CVE-2026-86296. The flaw has received the maximum CVSS severity score of 10.0. It may allow remote attackers to compromise vulnerable devices without authentication or user interaction. The issue affects the udhcpcd component in the reported DIR-822A firmware […]

Read the original article:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CVE-2026-86296 Zero-Day Vulnerability in D-Link DIR-822A Routers D-Link has disclosed a critical zero-day vulnerability (CVE-2026-86296) affecting its DIR-822A routers, which has a maximum CVSS score of 10.0. This stack-based buffer overflow flaw allows remote attackers to exploit the device without authentication or user interaction by sending crafted DHCP packets. The vulnerability affects the udhcpcd component in firmware version A_101 and can lead to device crashes or unauthorized code execution. A public proof-of-concept exploit has been released, increasing the risk of exploitation. D-Link is also investigating a second critical vulnerability (CVE-2026-86510) with a CVSS score of 9.9. Users are advised to restrict remote management access and monitor for firmware updates. No patches are currently available for either vulnerability. 10 sources 71

Extracted Entities

Companies (1)

D-Link Systems

CVEs (1)

CVE-2026-86296