Vulnerability · Published Sep 7, 2026 · Assigned by VulDB
CVE-2026-86300Tenda AC9 Web Management R7WebsSecurityHandler improper authentication
High 7.3
In plain English
A high-severity improper authentication in AC9 from Tenda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.8%top 41.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A flaw has been found in Tenda AC9 15.03.05.14. This impacts the function R7WebsSecurityHandler of the component Web Management. This manipulation causes improper authentication. The attack may be initiated remotely. The exploit has been published and may be used.
Affected products (as reported)
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-399464 | Tenda AC9 Web Management R7WebsSecurityHandler improper authentication vdb-entry, technical-description
- VDB-399464 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-86300 | CVE Analysis and Report third-party-advisory
- Submit #906606 | Tenda AC9 V15.03.05.14 Information Disclosure third-party-advisory
- Submit #906607 | Tenda AC9 V15.03.05.14_multi / V15.03.05.16_multi Improper Access Controls (Duplicate) third-party-advisory
- Submit #906608 | Tenda AC9 V15.03.05.14_multi / V15.03.05.16_multi Improper Access Controls (Duplicate) third-party-advisory
- https://github.com/limou89/somevul/blob/main/Tenda_AC9_getProduct_Info_Disclosure.md related
- https://github.com/limou89/somevul/blob/main/Tenda_AC9_fast_setting_wifi_set_Unauth_Password.md exploit
- https://www.tenda.com.cn/ product