High severity · published Jun 9, 2026
CVE-2026-9212
Insufficient authentication and input validation in certain NETGEAR products
8.0
CVSS
0.3%
EPSS
No
On KEV
Description
Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LB
LBR1020 · NETGEAR
before V2.6.4.60 · source: vendor
LB
LBR20 · NETGEAR
before V2.7.6.8 · source: vendor
R6
R6700AX · NETGEAR
0 · source: vendor
R7
R7800 · NETGEAR
before V1.0.4.96 · source: vendor
R9
R9000 · NETGEAR
before V1.0.6.46 · source: vendor
RA
RAX10 · NETGEAR
before V1.0.5.50 · source: vendor
RA
RAX10v2 · NETGEAR
before V1.0.5.50 · source: vendor
RA
RAX120 · NETGEAR
before V1.2.10.56 · source: vendor
RA
RAX120v1 · NETGEAR
before V1.2.10.56 · source: vendor
RA
RAX120v2 · NETGEAR
before V1.2.10.56 · source: vendor
RA
RAX36S · NETGEAR
before V1.0.5.50 · source: vendor
RA
RAX70 · NETGEAR
before V1.0.19.172 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-9212
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-9212
Patch
https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory
Product
https://www.netgear.com/support/product/lbr1020/
Product
https://www.netgear.com/support/product/lbr20/
Product
https://www.netgear.com/support/product/r6700ax/
Product
https://www.netgear.com/support/product/r7800/
Product
https://www.netgear.com/support/product/r9000/