CVE-2026-118865

Vendor

TP-Link

Product

Archer AX3000 v2

CVSS v4.0

7.3 AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness

CWE-78

Exposure class

Edge / VPN / firewall

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 37
   CVE NVD 2h ago

   An authenticated OS command injection vulnerability exists in the Offline Download component (USB storage allocation) of Archer AX3000 v2.

   An authenticated OS command injection vulnerability exists in the Offline Download component (USB storage allocation) of Archer AX3000 v2. When a USB storage device is attached, an authenticated administrator can submit a crafted…

   CVSS 7.3 CVE-2026-118865 TP-Link