High severity · published Sep 7, 2026
CVE-2026-86300
Tenda AC9 Web Management R7WebsSecurityHandler improper authentication
7.3
CVSS
0.8%
EPSS
No
On KEV
Description
A flaw has been found in Tenda AC9 15.03.05.14. This impacts the function R7WebsSecurityHandler of the component Web Management. This manipulation causes improper authentication. The attack may be initiated remotely. The exploit has been published and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
AC9 · Tenda
15.03.05.14 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86300
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86300
github.com
https://github.com/limou89/somevul/blob/main/Tenda_AC9_fast_setting_wifi_set_Unauth_Password.md
github.com
https://github.com/limou89/somevul/blob/main/Tenda_AC9_getProduct_Info_Disclosure.md
vuldb.com
https://vuldb.com/cve/CVE-2026-86300
vuldb.com
https://vuldb.com/submit/906606
vuldb.com
https://vuldb.com/submit/906607
vuldb.com
https://vuldb.com/submit/906608
More from AC9
9.8
CVE-2018-14558
Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability
9.8
CVE-2025-45042
Tenda AC9 v15.03.05.14 was discovered to contain a command injection vulnerability via the Telnet function
9.8
CVE-2025-44877
Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formSetSambaConf function via the usbname parameter
9.8
CVE-2025-44872
Tenda AC9 V15.03.06.42_multi was found to contain a command injection vulnerability in the formsetUsbUnload function via the deviceName parameter
9.8
CVE-2025-45429
In the Tenda ac9 v1.0 router with firmware V15.03.05.14_multi, there is a stack overflow vulnerability in /goform/WifiWpsStart, which may lead to remote arbitrary code execution