Critical

D-Link warns of max severity zero-day bug in DIR-822A routers

BleepingComputer

September 22, 2026 at 12:48 PM

Actively Exploited

CVE Zero-day Exploit Vulnerability Patch

Overview

D-Link has issued a warning about a serious vulnerability, identified as CVE-2026-86296, that affects its legacy DIR-822A dual-band Wi-Fi routers. This zero-day bug has been assigned the highest severity rating, and there is currently no patch available to fix the issue. With proof-of-concept exploit code publicly accessible, attackers could potentially exploit this vulnerability to compromise these devices. Users of the DIR-822A routers should take immediate precautions to secure their networks, as the lack of a fix leaves them vulnerable to attacks. D-Link's warning emphasizes the need for users to remain vigilant and consider upgrading to more secure router models.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: D-Link DIR-822A dual-band Wi-Fi routers
Action Required: D-Link has not provided a patch for this vulnerability.
Timeline: Newly disclosed

Original Article Summary

D-Link warned customers of a maximum-severity vulnerability (CVE-2026-86296) with public proof-of-concept (PoC) exploit code and no patch, affecting legacy DIR-822A dual-band Wi-Fi routers. [...]

Impact

D-Link DIR-822A dual-band Wi-Fi routers

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

D-Link has not provided a patch for this vulnerability. Users are advised to take immediate action to secure their networks, possibly by disabling remote management features and ensuring strong passwords. Upgrading to a newer router model is also recommended.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Zero-day, Exploit, and 2 more.

Read Original Article

Related Coverage

New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory

The Hacker News

A newly discovered flaw in the Linux kernel's KVM virtualization code for ARM64 processors poses a significant risk. This vulnerability, identified as CVE-2026-89775, allows guest virtual machines with nested virtualization enabled to gain read-write access to freed host memory. Researchers warn that this could enable attackers to escape the guest environment and execute code directly on the host machine. This issue is particularly concerning for systems that rely heavily on virtualization for security and isolation, as it could compromise the integrity of the host operating environment. Users and organizations utilizing ARM64 virtualization should be aware of this vulnerability and take necessary precautions.

Sep 22, 2026

SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE

The Hacker News

A vulnerability in SharePoint Server, originally labeled by Microsoft as a spoofing flaw with a CVSS score of 6.5, has been reclassified to allow for authenticated remote code execution (RCE). This flaw, identified as CVE-2026-65660, impacts SharePoint Server versions 2016, 2019, and Subscription Edition. Researcher Dinh Ho Anh Khoa from Viettel Cyber Security provided detailed technical insights, revealing the severity of the issue. The ability for attackers to execute remote code poses significant risks, especially for organizations relying on these SharePoint versions for collaboration and data management. Microsoft has released patches to address this vulnerability, and users are urged to apply these updates promptly to protect their systems.

Sep 22, 2026

Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal

The Hacker News

Researchers have discovered a malicious npm package called 'indexed-btree' that masquerades as a legitimate tool used for B-tree indexing. Unlike typical malicious packages that employ lifecycle scripts to execute harmful actions, this one hides its malicious behavior within the application code itself. This shift in tactics suggests that attackers are adapting to new security measures that aim to protect users from obvious threats. The package mimics a trusted utility, potentially tricking developers into integrating it into their projects. This incident raises concerns for developers and organizations relying on npm packages, as it illustrates the evolving nature of supply chain attacks in the software development ecosystem.

Sep 22, 2026

SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing

The Hacker News

The cyber group known as SideCopy has shifted its focus to academic institutions in India, previously known for targeting government entities. Researchers from Trellix have reported that SideCopy is employing spear-phishing tactics that utilize mshta.exe to run harmful scripts, effectively bypassing typical security measures. This change in target demographic raises concerns about the security of educational institutions, which may not have the same level of protection as government systems. The use of advanced phishing techniques indicates a growing sophistication in SideCopy's operations, posing a significant risk to sensitive academic data and research. Institutions need to bolster their cybersecurity defenses to protect against such tailored attacks.

Sep 22, 2026

One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor

The Hacker News

A security vulnerability has been discovered in Meta's Muse assistant that could allow malware already on a Mac to hijack the assistant. Researcher Patrick Wardle demonstrated that by modifying a hidden setting, attackers could redirect voice commands meant for Muse to themselves. This means that any sensitive information users dictate could be intercepted by malicious actors. The issue stems from the broad permissions granted to the Muse app, which can be exploited if the malware is already present on the device. This incident raises concerns about the security of AI assistants and the potential for them to be weaponized against users.

Sep 22, 2026

WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session

The Hacker News

A recently discovered vulnerability in WordPress, known as 'Comment2Shell' and tracked as CVE-2026-93485, allows anonymous users to leave comments that can inject hidden scripts into web pages. If an administrator then views the page, the script can execute code on the server, potentially allowing attackers to take control of the site. This issue was addressed in version 7.1.1, released on September 17, 2023. Site owners are urged to update their WordPress installations immediately to protect against this flaw, which poses significant risks to website security. Failure to patch could leave sites vulnerable to remote code execution attacks.

Sep 22, 2026