CVE-2026-27850 Improper verification in Linksys MR9600, Linksys MX4200
Improper firewall configuration allows remote attackers to access internal services via the WAN port, bypassing network isolation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-27850?
CVE-2026-27850 is a high-severity vulnerability in Linksys MR9600, published on 25 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Due to an improperly configured firewall rule, the router will accept any connection on the WAN port with the source port 5222, exposing all services which are normally only accessible through the local network. This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.
Which versions are affected by CVE-2026-27850?
How do I fix CVE-2026-27850?
No fix has been published for CVE-2026-27850 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-27850 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27850 exists.
Sources
Also known as GHSA-j57x-8g4m-v9v5.