CVE-2026-32678 Auth bypass in BUFFALO Wi-Fi router products
Attackers can bypass authentication to alter critical configuration settings on BUFFALO Wi-Fi routers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-32678?
CVE-2026-32678 is a high-severity authentication bypass vulnerability in BUFFALO Wi-Fi router products, published on 27 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Authentication bypass issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to alter critical configuration settings without authentication.
Weakness: CWE-288
Which versions are affected by CVE-2026-32678?
It affects 46 products.
Products include Buffalo Fs-M1266 Firmware, Buffalo Fs-S1266 Firmware, Buffalo Vr-U300w Firmware, Buffalo Vr-U500x Firmware, Buffalo Wapm-1266r Firmware, Buffalo Wapm-1266wdpr Firmware and 40 more.
How do I fix CVE-2026-32678?
No fix has been published for CVE-2026-32678 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-32678 being exploited?
There is no known exploitation of CVE-2026-32678 in the wild and no public exploit code.
Other vulnerabilities in BUFFALO Wi-Fi router products
Sources
Also known as GHSA-x9gr-c22h-6mqf.