Critical severity · published Aug 16, 2026
CVE-2026-19924
Tenda AC10 httpd R7WebsSecurityHandler improper authentication
9.8
CVSS
1.4%
EPSS
No
On KEV
Description
A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the function R7WebsSecurityHandler of the component httpd. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
AC10 · Tenda
16.03.10.09_multi_TDE01 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19924
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19924
github.com
https://github.com/teiwiet/tenda-ac10-vulnerabilities/blob/main/authen-bypass-tenda-ac10.md
vuldb.com
https://vuldb.com/cve/CVE-2026-19924
vuldb.com
https://vuldb.com/submit/871957
vuldb.com
https://vuldb.com/vuln/390174
vuldb.com
https://vuldb.com/vuln/390174/cti
www.tenda.com.cn
https://www.tenda.com.cn/
More from AC10
9.8
CVE-2018-14558
Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability
9.8
CVE-2025-67073
A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code…
9.8
CVE-2025-12622
A vulnerability was determined in Tenda AC10 16.03.10.13
9.8
CVE-2025-5629
A vulnerability, which was classified as critical, was found in Tenda AC10 up to 15.03.06.47
9.8
CVE-2025-45779
Tenda AC10 V1.0re_V15.03.06.46 is vulnerable to Buffer Overflow in the formSetPPTPUserList handler via the list POST parameter