CVE-2026-120276 — Public exploit reported for WAVLINK WN536AX6-A web management command injection

48/100

WAVLINK WN536AX6-A V260507_2.0.0 has a remotely reachable OS command injection vulnerability through group_name in the Web Management Interface function sub_416760 in /bin/ioos. An exploit is public; authentication requirements, deployment prerequisites and fixed versions need checking in the supplier advisory.

• CVSS 9.3
• CWE-77

Digest of 2026-11-02

Sources

• NVD — critical CVEs (CVSS ≥ 9) — CVE-2026-120276 (CVSS 9.3)