Vulnerability · Published Aug 8, 2026 · Assigned by VulnCheck
CVE-2026-71986MSI Radix AXE6600 v781521 Command Injection via dmz Function
Critical 9.8
In plain English
A critical-severity OS command injection in Radix AXE6600 from MSI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)2.5%top 15.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the dmz function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the dmz function to execute malicious commands and obtain root privileges on the underlying system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MSI | Radix AXE6600 | 0 – through v781521 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- MSI Vendor Site product
- Fix Version Download patch
- https://www.vulncheck.com/advisories/msi-radix-axe6600-v781521-command-injection-via-dmz-function third-party-advisory