High severity · published Oct 13, 2026
CVE-2026-11732
Insufficient input validation vulnerability exists in website blocking feature of certain NETGEAR RAX/CAX series models
8.8
CVSS
0.2%
EPSS
No
On KEV
Description
An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
CAX30 · NETGEAR
before V2.3.4.12 · source: vendor
RA
RAX30 · NETGEAR
before V1.0.14.108 · source: vendor
RA
RAX5 · NETGEAR
before V1.0.5.34 · source: vendor
RA
RAXE300 · NETGEAR
before V1.0.10.72 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-11732
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-11732
product
https://www.netgear.com/support/product/cax30/
product
https://www.netgear.com/support/product/rax5/
product
https://www.netgear.com/support/product/rax30/
product
https://www.netgear.com/support/product/raxe300/
vendor-advisory
https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisory
More from CAX30
8.8
CVE-2026-9211
Certain NETGEAR routers allow unauthenticated users to gain control of the router
