Critical CVE-2026-86296 Flaw Found in D-Link DIR-822A Routers

• •CVE-2026-86296 is a critical vulnerability with a CVSS score of 10.0.
• •The flaw allows remote exploitation without authentication, posing a severe risk.
• •Public proof-of-concept exploits are available, increasing the likelihood of attacks.

D-Link has disclosed a critical security vulnerability in its DIR-822A routers, tracked as CVE-2026-86296, which has a CVSS score of 10.0. This stack-based buffer overflow flaw allows remote attackers to exploit the device without authentication or user interaction. The vulnerability affects the udhcpcd component of the router's firmware, enabling attackers to send crafted DHCP packets that can lead to device crashes or unauthorized code execution. A public proof-of-concept exploit has been released, increasing the risk of active exploitation. Additionally, another critical vulnerability, CVE-2026-86510, has been identified in the same router model, which also has a public PoC available. D-Link is currently investigating both vulnerabilities and has not yet released patches. Users are advised to restrict remote management access and monitor for firmware updates. The vulnerabilities primarily affect devices exposed to the internet.