CVE-2026-86530

HighCVSS 7.2/10Last modified Sep 30, 2026

Description

BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a crafted HTTP request and execute an arbitrary OS command.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 28, 2026
Last modified: Sep 30, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-865339.1Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to re CVE-2026-865358.7Loop with unreachable exit condition ('infinite loop'), Improperly controlled modification of object prototype attributes ('prototype pollut CVE-2026-865366.3Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings. CVE-2026-865378.7Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache T CVE-2026-865387.5knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated CVE-2026-865397.2knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbo CVE-2026-86548.7Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands CVE-2026-865407.8knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to CVE-2026-865418.3knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite CVE-2026-865429.1knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the impo CVE-2026-865439.8knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password require CVE-2026-865448.1knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-o