Home / Vulnerability Intelligence / CVE-2026-26794

CVE-2026-26794 - Vulnerability Analysis

HighCVSS: 8.8

Last Updated: March 13, 2026

GL-iNet GL-AR300M16 - SQL Injection

Published: March 12, 2026Updated: March 13, 2026PoC AvailableRemote Exploitable

Overview

GL-iNet GL-AR300M16 v4.3.11 contains a sql injection caused by improper sanitization in the add_group() function, letting attackers execute arbitrary SQL database operations via crafted HTTP requests.

Severity & Score

Severity: High

CVSS Score: 8.8

EPSS Score: 1.2%(Probability of exploitation in next 30 days)

Impact

Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or full database compromise.

Mitigation

Update to the latest version.

References

https://github.com/sezangel/IOT-vul/tree/main/GL-iNet/GL-AR300M16/acl--add_group

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

Mar 13, 2026

🟠 CVE-2026-26794 - High (8.8) GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the add_group() function. This vulnerability allows attackers to execute arbitrary SQL database operations via a crafted HTTP request. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26794/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

Mar 13, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-26794
Severity: High
CVSS Score: 8.8
Type: sql_injection
Status: confirmed
EPSS: 1.2%
Social Posts: 2

CWE

CWE-89

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

1.2%Probability of exploitation in the next 30 days