CVE-2026-8263

Description

A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of the component httpd. Performing a manipulation of the argument mac/ssid results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

Overview

State: PUBLISHED
Assigner (CNA): VulDB
CVSS severity: MEDIUM
CVSS score: 5.1 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Effective score: 5.1 / 10 MEDIUM source: CNA overview
CWE(s): CWE-78, CWE-77
Reserved: 2026-05-10
Published: 2026-05-11 04:00 UTC
Last updated: 2026-05-11 19:31 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/8xxx/CVE-2026-8263.json
Linked Threat: CVE-2026-8263 — CVE-2026-8263

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-05-11 02:16:28 UTC
NVD last modified: 2026-05-12 19:41:18 UTC
NVD CVSS v3.1: 4.7 / 10 MEDIUM source: cna@vuldb.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Exploitability subscore: 1.2 / 10
Impact subscore: 3.4 / 10
EPSS score: 0.0035 (probability of exploitation in next 30 days)
EPSS percentile: 57.22% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

NVD-assigned CWE(s): CWE-77, CWE-78, CWE-787 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-29019
Assigner: VulDB
Published: May 11, 2026, 2:00:16 AM
Updated: May 11, 2026, 5:31:16 PM
EUVD base score (CVSS 4.0): 5.1 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EUVD-reported EPSS: 0.3500
Vendors: Tenda
Products: AC6 (15.03.06.49_multi_TDE01)

ENISA description: A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of the component httpd. Performing a manipulation of the argument mac/ssid results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

EUVD references (5)

Affected products (1)

Vendor	Product	Versions	Platforms
Tenda	AC6	`15.03.06.49_multi_TDE01` (affected)	—

Affected products — CPE 2.3 (2) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:o:tenda:ac10u_firmware:15.03.06.49_multi_tde01:*:*:*:*:*:*:*
cpe:2.3:h:tenda:ac10u:1.0:*:*:*:*:*:*:*

Vendor references (5)

References embedded in the original CVE record by the assigning CNA.

VDB-362560 | Tenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injection vdb-entrytechnical-description
VDB-362560 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required
Submit #810074 | Tenda AC6 V2.0 (AC1206) Firmware V15.03.06.23 Command Injection via mac/ssid third-party-advisory
https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/fromSetWirelessRepeat.md exploit
https://www.tenda.com.cn/ product

MITRE references (5) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

VDB-362560 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/fromSetWirelessRepeat.md exploit
https://www.tenda.com.cn/ product
Submit #810074 | Tenda AC6 V2.0 (AC1206) Firmware V15.03.06.23 Command Injection via mac/ssid third-party-advisory
VDB-362560 | Tenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injection vdb-entry, technical-description

Web references (3)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

https://www.cve.org/CVERecord?id=CVE-2026-8263 tenable:www.cve.org
https://www.first.org/epss/ tenable:www.first.org
https://nvd.nist.gov/vuln/detail/CVE-2026-8263 tenable:nvd.nist.gov

NVD-tagged references (5)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/fromSetWirelessRepeat.md cna@vuldb.com ExploitThird Party Advisory
https://vuldb.com/submit/810074 cna@vuldb.com Third Party AdvisoryVDB Entry
https://vuldb.com/vuln/362560 cna@vuldb.com Third Party AdvisoryVDB Entry
https://vuldb.com/vuln/362560/cti cna@vuldb.com Permissions RequiredVDB Entry
https://www.tenda.com.cn/ cna@vuldb.com Product

Remediations (16)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

CISA gives agencies until Friday to patch critical cyber bug

web:federalnewsnetwork.com

CISA's latest emergency directive tells agencies to immediately patch critical vulnerabilities in Cisco networking devices.

2026-05-23 21:02 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-23 21:02 UTC
Cisco fixed maximum severity flaw CVE-2026-20223 in Secure Workload

web:securityaffairs.com

Cisco fixed a critical Secure Workload flaw ( CVE - 2026 -20223) that could let attackers gain Site Admin privileges through crafted API requests. Cisco released patches for a critical vulnerability, tracked as CVE - 2026 -20223 (CVSS score of 10.0), in Secure Workload. The flaw stems from insufficient validation and authentication in REST API endpoints. According to Cisco, remote attackers could ...

2026-05-23 21:02 UTC
VMware ESXi 8.0 Update 3d Release Notes

web:techdocs.broadcom.com

What's New This release resolves CVE -2025-22224, CVE -2025-22225, and CVE -2025-22226. For more information on these vulnerabilities and their impact on Broadcom products, see VMSA-2025-0004.

2026-05-23 21:02 UTC
Cisco Fixes CVE-2026-20223 Secure Workload API Flaw

web:thecyberexpress.com

Cisco has released security updates to fix a critical vulnerability, tracked as CVE - 2026 -20223, affecting its Cisco Secure Workload platform. The flaw, which received the maximum CVSS score of 10.0, could allow an unauthenticated remote attacker to access sensitive information and make unauthorized configuration changes through vulnerable REST ...

2026-05-23 21:02 UTC
KB5082063 Causing Update Failures on Windows Server 2025, Microsoft ...

web:windowsreport.com

A new issue follows a recent fix The development comes shortly after Microsoft resolved a separate problem that caused some systems to upgrade to Windows Server 2025 automatically without administrator intent. While that issue has been addressed, the latest update failures suggest the platform is still facing early stability challenges.

2026-05-23 21:02 UTC
Microsoft fixes KB5082063 Windows Server domain controller reboot loops

web:www.notebookcheck.net

Microsoft has released emergency out-of-band updates KB5091157 and KB5091575 to fix LSASS crashes and domain controller reboot loops caused by the April 2026 KB5082063 update.

2026-05-23 21:02 UTC
Oracle Critical Patch Update Advisory - April 2026

web:www.oracle.com

This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

2026-05-23 21:02 UTC
CVE 2026 — The Vulnerabilities That Matter Most Right Now

web:www.penligent.ai

Second, chipset and OEM dependencies make remediation slower and messier than software-only patching. Google's bulletin explains the two Android patch levels for March 2026 and clarifies that devices with security patch levels of 2026 -03-01 or 2026 -03-05 are protected against the associated issues, depending on applicable components.

2026-05-23 21:02 UTC
Quantifying 2026 Routinely Targeted Vulnerabilities (So Far)

web:www.vulncheck.com

VulnCheck identified 25 CVEs disclosed in 2026 that have been routinely targeted by adversaries and researchers so far this year, drawing from a global body of exploit code and exploitation data.

2026-05-23 21:02 UTC
Windows Kerberos RC4 deprecation: what will break in Active ... - 4sysops

web:4sysops.com

Starting in April 2026 , Windows updates will change the default Kerberos ticket issuance behavior to AES-SHA1 for accounts without explicit encryption settings, while RC4 can still be used where explicitly enabled. This change, driven by CVE - 2026 -20833, affects every Windows Server environment where service accounts or devices still rely on RC4. Any service account, NAS device, or legacy ...

2026-05-26 02:47 UTC
THREAT ADVISORY RedSun Zero-Day (Windows Defender) April 17, 2026

web:blackswan-cybersecurity.com

Cloud Files API activity originating outside legitimate OneDrive/sync processes. Mitigation Steps: Apply all Windows updates immediately (monitor MSRC for an emergency RedSun-specific patch . None released as of April 17, 2026 ). Supplement Defender with a secondary EDR solution (e.g., Huntress) capable of detecting Defender bypasses.

2026-05-26 02:47 UTC
CISA Warns of Exploited Microsoft Defender 0-Day Flaws

web:cyberpress.org

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing an urgent remediation directive for federal agencies with a due date of June 3, 2026 .

2026-05-26 02:47 UTC
Nvd - Cve-2026-8263

web:nvd.nist.gov

Official websites use .gov A .gov website belongs to an official government organization in the United States.

2026-05-26 02:47 UTC
May 2026 Patch Tuesday: Updates and Analysis | CrowdStrike

web:www.crowdstrike.com

Microsoft has released security updates for 130 vulnerabilities, including 30 critical, in its May 2026 Patch Tuesday rollout.

2026-05-26 02:47 UTC
Microsoft confirms new BitLocker bug in latest Windows and Server ...

web:www.notebookcheck.net

Microsoft confirmed that its April 2026 security updates, including KB5082063 and KB5083769, are triggering BitLocker recovery prompts on some Windows Server 2025, Windows 11, and Windows 10 devices.

2026-05-26 02:47 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-8263.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-8263",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-11T15:56:51.720245Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-11T17:31:16.800Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:o:tenda:ac6_firmware:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "httpd"
          ],
          "product": "AC6",
          "vendor": "Tenda",
          "versions": [
            {
              "status": "affected",
              "version": "15.03.06.49_multi_TDE01"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "ST4R (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of the component httpd. Performing a manipulation of the argument mac/ssid results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5.8,
            "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "OS Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T02:00:16.521Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-362560 | Tenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/362560"
        },
        {
          "name": "VDB-362560 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/362560/cti"
        },
        {
          "name": "Submit #810074 | Tenda AC6 V2.0 (AC1206) Firmware V15.03.06.23 Command Injection via mac/ssid",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/810074"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/fromSetWirelessRepeat.md"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.tenda.com.cn/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-10T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-05-10T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-05-10T17:40:47.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Tenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-8263",
    "datePublished": "2026-05-11T02:00:16.521Z",
    "dateReserved": "2026-05-10T15:35:34.814Z",
    "dateUpdated": "2026-05-11T17:31:16.800Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}