A critical vulnerability in the WAVLINK WN536AX6-A router, published on 2 November 2026, allows remote operating-system command injection, according to the CVE record. The flaw, CVE-2026-120279, is rated 10.0 out of 10, the maximum severity score, and affects firmware version V260507.

How the flaw works

The vulnerability sits in the router's OpenVPN handling component, in the file /protocol.csp. Manipulating the file_id argument in the openvpn_cli handler can lead to operating-system command injection, meaning an attacker can trick the device into running commands on its operating system. The attack can be launched remotely, without needing to be on the local network, and the CVE record does not list a fixed version.

Exploit status, stated carefully

CVE trackers differ in how they describe exploit availability for this flaw. StackFlag's record states that the exploit has been published and may be used, and the vendor was contacted early about the disclosure. Another tracker, The Hacker Wire, states that no public exploit code has been confirmed for this CVE at this time. Readers should therefore treat the exploit question as contested between trackers, while the underlying flaw itself — remote command injection in the named firmware — is recorded in the CVE entry itself. The flaw is not claimed here to be in CISA's Known Exploited Vulnerabilities catalogue.

What owners should do

Until a vendor fix is available, owners of the named model should check the vendor's site for a security update, restrict remote access to the router's management interfaces, and consider isolating the device from untrusted networks. The same day also saw further critical CVEs for the same model, including CVE-2026-120280 in its WireGuard handling, so owners should check for the whole model, not just one flaw.

Sources: StackFlag, CVE-2026-120279; OffSeq Threat Radar; CVEFeed CVE record, 2 November 2026.