Vulnerability · Published Sep 8, 2026 · Assigned by NETGEAR
CVE-2026-9215A CSRF vulnerability exists in certain NETGEAR XR series devices
Medium 6.7
In plain English
A medium-severity cross-site request forgery in XR1000v2 from NETGEAR. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Severity (CVSS 3.1)6.7Medium
Exploit odds (30 days)0.2%top 90.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations with active assistance from the router administrator. There is no confidentiality impact due to this vulnerability.
Affected products (as reported)
Weakness: CWE-352 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
References
- https://www.netgear.com/support/product/xr500 product, patch
- https://www.netgear.com/support/product/xr1000 product, patch
- https://www.netgear.com/support/product/xr1000v2 product, patch
- https://kb.netgear.com/000070912/September-2026-NETGEAR-Security-Advisory vendor-advisory, patch