CVE-2026-49185 Instruction Injection via FieldX MDM

What is CVE-2026-49185?

CVE-2026-49185 is a critical command injection vulnerability in Acer Connect M6E 5G Portable WiFi Router, published on 4 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The FieldX MDM adb messaging topic passes unverified payloads directly into Runtime.exec(), allowing command/instruction injection.

Weakness: CWE-78

Which versions are affected by CVE-2026-49185?

It affects 1 product.

Products include Acer Connect M6e 5g Firmware.

How do I fix CVE-2026-49185?

No fix has been published for CVE-2026-49185 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-49185 being exploited?

There is no known exploitation of CVE-2026-49185 in the wild and no public exploit code.

Other vulnerabilities in Acer Connect M6E 5G Portable WiFi Router

• CVE-2026-49190 Missing Per-Instruction Authorization Checks Critical 9.4
• CVE-2026-49194 SCREEN_CLICK Authentication Bypass Critical 9.4
• CVE-2026-49191 Exposed Hard-coded M3WebServer Backend API Key Critical 9.3
• CVE-2026-50209 MDM Server Registration Overriding Critical 9.3
• CVE-2026-50214 Shared Secret Quota Inflation Critical 9.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-78x5-76fx-mcp6.