GoKawiilNetgear patches medium-severity command-injection flaw in several router models
Netgear has issued a security advisory for CVE-2026-11732, a vulnerability that lets an attacker already on a user's network run unauthorized commands on certain routers if the Block Sites feature is enabled. Affected models include the CAX30, RAX30, RAX5, and RAXE300, and Netgear has released firmware updates for all supported devices. One model, the RAX5, has reached end of support and will not receive further patches.
GoKawiil's interpretation of the reporting above, not reported fact.
The flaw requires prior network access, such as stolen Wi-Fi credentials, which limits its reach but still leaves home and small-office networks exposed to lateral attacks. Users of the discontinued RAX5 model face ongoing risk since no future fixes will be provided, illustrating the security tradeoffs of using hardware past its support window.
- Netgear disclosed CVE-2026-11732, a medium-severity flaw tied to the Block Sites feature.
- Firmware updates are available for the CAX30, RAX30, RAX5, and RAXE300 routers.
- The RAX5 has reached end of support, so it won't get further security updates.
NETGEAR Nighthawk WiFi 6 Router — If your current Netgear router has reached end-of-support and won't receive security patches, it's a good time to upgrade to a modern, actively supported model like the Nighthawk WiFi 6 series. Newer routers get regular firmware updates to address vulnerabilities like the one described in this article, plus improved speed and security features.
See NETGEAR Nighthawk WiFi 6 Router on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: zdnet.com — Lance Whitney, 2026-10-30
Published there as: “Your Netgear router may be vulnerable to a security exploit – how to check and patch it”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.