CVE-2026-11731CWE-288

CVE-2026-11731

High · published October 13, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
18.0
In the wild
Unconfirmed
What it is

An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
6.3 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/V:D/U:Amber
EPSS
0.00268 · 18.0th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2026-10-13T19:17Z
References (2)
https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisory · a2826606-91e7-4eb6-899e-8484bd4575d5https://www.netgear.com/support/product/rax30 · a2826606-91e7-4eb6-899e-8484bd4575d5
EPSS history
Timeline
  • 15 OCT 03:29Z
    EPSS moved — → 0%
    epss
  • 13 OCT 14:41Z
    Authentication Bypass Vulnerability in Certain NETGEAR RAX Series Models
    cvelistv5
  • 13 OCT 14:41Z
    Authentication Bypass Vulnerability in Certain NETGEAR RAX Series Models
    cvelistv5