CVE-2026-18686

CriticalCVSS 9.8/10Last modified Oct 23, 2026

Description

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.add_user of the file /cgi-bin/glc of the component nas-web RPC Wrapper. Performing a manipulation results in command injection. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Aug 4, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-186877.1MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the c CVE-2026-186887.1An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a CVE-2026-18696.5The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & L CVE-2026-186908.1An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected syst CVE-2026-186918.8An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authenticati CVE-2026-186928.8An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an int CVE-2026-186937.6An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal CVE-2026-186947.1An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed CVE-2026-186956.5An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authentica CVE-2026-186966.5An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data CVE-2026-186977.5An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unex CVE-2026-186985.4An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected syst