CVE-2026-86299

CRITICAL 9.9

Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injection

CVSS Score

9.9

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was detected in Linksys RE7000 2.0.15. This affects the function platform_event_pingTest of the file /cgi-bin/json.cgi?PingTest of the component PingTest Handler. The manipulation of the argument pingTestIp/pingTestPktSize/pingTestTimes results in os command injection. The attack can be launched remotely. The exploit is now public and may be used.

CWE	CWE-78 CWE-77
Vendor	linksys
Product	re7000
Published	Sep 7, 2026
Last Updated	Sep 11, 2026

Stay Ahead of the Next One

Get instant alerts for linksys re7000

Be the first to know when new critical vulnerabilities affecting linksys re7000 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Linksys / RE7000

2.0.15

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/399463 vuldb.com: https://vuldb.com/vuln/399463/cti vuldb.com: https://vuldb.com/cve/CVE-2026-86299 vuldb.com: https://vuldb.com/submit/906547 github.com: https://github.com/limou89/somevul/blob/main/Linksys_RE7000_v2_PingTest_Command_Injection.md linksys.com: https://www.linksys.com/

Credits

🔍 sleep (VulDB User)