ZDNET’s key takeaways
- Certain Netgear routers are vulnerable to security exploits.
- Netgear has released patches for all supported models.
- Some routers have reached end of support, which means no further updates.
Do you have a Netgear router? The bad news is that the device may be susceptible to a security flaw that leaves it vulnerable to an attacker. The good news: This exploit only affects a small number of Netgear routers, and the company has already issued patches to destroy the bugs.
Also: Run this 10-step security check on your phone once a year
The vulnerabilities differ slightly between the different affected models, as described in Netgear’s security advisory. In general, these flaws can be exploited by an attacker who gains access to your network, allowing them to execute unauthorized and potentially malicious commands on the router.
All the flaws are classified as medium severity but clearly still a threat, prompting Netgear to roll out new firmware for each affected model. You should be able to update your router to the latest firmware directly through its settings, but you can also grab any update from the Netgear website.
CVE-2026-11732
Described in CVE-2026-11732, the first vulnerability could allow an attacker who already has access to your network, most likely through your Wi-Fi credentials, to execute unauthorized commands on the device. The flaw is only exploitable if you have enabled the Block Sites feature, which blocks access to specific websites based on domain name or keywords.
Also: Firefox and Chrome patch 200+ security flaws combined
Affected products and firmware download pages to patch the bug:
Among these, the RAX5 4-Stream AX1600 WiFi 6 router has reached end of service (EoS), which means that no further updates will be available after this last one. In this case, Netgear advises owners to upgrade to a newer router.
CVE-2026-11731
Defined in CVE-2026-11731, the second vulnerability can allow an unauthenticated attacker with access to your local network and your router management service view and change various device details and administrative settings.
Also: Chrome now warns you about suspicious websites
Affected products and the download pages to patch the bug:
CVE-2026-11730
Documented in CVE-2026-11730, the third vulnerability affects two Netgear range extenders. Here, an attacker who already has access to local networks can hijack an authenticated administrator session on the device’s web management portal.
Affected products and their firmware download pages:
Among these two, the EX3700 AC750 WiFi Range Extender Essentials Edition has reached end of service, which means it’s time to move to a newer device.
The remaining routers affected by security flaws have all reached end of service. Again, this means no further updates are available, and Netgear advises owners to switch to a newer device.
CVE-2026-9218
Described in CVE-2026-9218, an attacker who is connected to the router’s local network and has the administrator username and password can run unauthorized commands on the device.
Also: The best Wi-Fi routers: expertly tested and reviewed
Affected products and their firmware download pages:
With the CBR40 Orbi AC2200 Tri-Band WiFi Cable Modem Router, the latest firmware will not fix the current security flaw, so owners will have to move to a newer device to stay safe.
The remaining Netgear router affected by security flaws is also at end of service, and the latest firmware will not fix its security flaws. Again, Netgear advises owners to switch to a new and more secure device.
Affected product and firmware download page: