CVE-2026-3088

MediumCVSS 6.5/10Last modified Jul 23, 2026

Description

Unauthenticated users on the local network can cause the router to become unavailable by sending specially crafted requests.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
NETGEAR	RBR860	>= V6.3.7.10, < V7.2.7.15
NETGEAR	RBRE950	< v7.2.7.15
NETGEAR	RBRE960	>= V6.3.7.10, < V7.2.7.15
NETGEAR	RBE970	>= V6.3.7.10, < V9.10.1.4
NETGEAR	RBE971	>= V6.3.7.10, < V9.10.1.4
NETGEAR	RBS860	< V7.2.7.15
NETGEAR	RBSE950	< v7.2.7.15
NETGEAR	RBSE960	< V7.2.7.15

References

https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-AdvisoryVendor Advisory
https://www.netgear.com/support/product/rbr860/Product
https://www.netgear.com/support/product/rbre950/Product
https://www.netgear.com/support/product/rbre960/Product
https://www.netgear.com/support/product/rbs860/Product
https://www.netgear.com/support/product/rbse950/Product
https://www.netgear.com/support/product/rbse960/Product

Timeline

Published: Jun 9, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-308809.8baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has an OS command injection vulnerability in the installer. Th CVE-2026-308818.8Chamilo LMS is a learning management system. Version 1.11.34 and prior contains a SQL Injection vulnerability in the statistics AJAX endpoin CVE-2026-308826.1Chamilo LMS is a learning management system. Chamilo LMS version 1.11.34 and prior contains a Reflected Cross-Site Scripting (XSS) vulnerabi CVE-2026-308837.8ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an CVE-2026-308849.6mdjnelson/moodle-mod_customcert is a Moodle plugin for creating dynamically generated certificates with complete customization via the web b CVE-2026-308855.3WWBN AVideo is an open source video platform. Prior to 25.0, the /objects/playlistsFromUser.json.php endpoint returns all playlists for any CVE-2026-308866.5New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.11.4-alpha.2, an CVE-2026-308879.9OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members to run custom Playwr CVE-2026-308885.5Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 allow a moderator to edit site CVE-2026-308894.9Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a moderator could exploit insu CVE-2026-30896.5Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper val CVE-2026-308908.0Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the