Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 8.6 .0374 89.5 —
AFFECTED Product Versions Fixed RE7000 2.0.15 – —
TIMELINE Sep 6 Reserved by VulDB Sep 7 Published (CNA: VulDB) Sep 11 EXPLOIT PUBLISHED — CVE-2026-86299 (Linksys RE7000). Public exploit reference added.
A vulnerability was detected in Linksys RE7000 2.0.15. This affects the function platform_event_pingTest of the file /cgi-bin/json.cgi?PingTest of the component PingTest Handler. The manipulation of the argument pingTestIp/pingTestPktSize/pingTestTimes results in os command injection. The attack can be launched remotely. The exploit is now public and may be used.
| Date | Event | Detail |
|---|---|---|
| September 6, 2026 | Reserved | Reserved by VulDB |
| September 7, 2026 | Published | Published (CNA: VulDB) |
| September 11, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-86299 (Linksys RE7000). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Linksys | RE7000 | — | 2.0.15 | — |
Authoritative record: CVE-2026-86299 at cve.org
Vendors: linksys
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-86299 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
