CVE-2026-86296PoC

HIGHCVSS 9.3 · CRITICAL

Exploitation observed; activity peaked at 11 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

A vulnerability was determined in D-Link DIR-822A A_101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Back to dashboard

7.8/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-119CWE-121

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

Active exploitation appears in 2 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
25 mentions across 8 observed days

What's happening

Active exploitation reported across 2 signals
Exploit tool or code specified in 1 signal
PoC mentioned or linked in 12 signals
Patch or workaround mentioned in 3 signals
Technical details provided in 21 signals
Disclosure: 9 classified signals
Peaked 4d ago at 11 mentions (2026-09-22); latest day: 1
25 total mentions across 8 days

Deep dive

Activity timeline25 mentions / 8d

Signal classification6 categories

PoC

1040.0%

Disclosure

936.0%

Active Exploitation

28.0%

General

28.0%

Patch

14.0%

Exploit

14.0%

Referenced assets17 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-06	1	Disclosure1
2026-09-07	2	Disclosure1Patch1
2026-09-08	3	Active Exploitation1Disclosure1General1
2026-09-22	11	Disclosure3Exploit1General1PoC6
2026-09-23	4	Active Exploitation1Disclosure1PoC2
2026-09-24	1	Disclosure1
2026-09-25	2	Disclosure1PoC1
2026-09-30	1	PoC1

Full discourse20 posts

Teegra 🧝‍♀️𝕏@Teeegra30d
PoC
شرکت دی‌لینک (D-Link) به مشتریان خود درباره یک آسیب‌پذیری با شدت حداکثری (CVE-2026-86296) هشدار داد که کد اکسپلویت اثبات (PoC) آن به‌صورت عمومی منتشر شده و هنوز وصله امنیتی (patch) برای آن ارائه نشده است! این نقص، روترهای قدیمی و دو‌باندی وای‌فای مدل DIR-822A را تحت تأثیر قرار می‌دهد و ناشی از سرریز بافر مبتنی بر پشته (stack-based buffer overflow) و پردازش نادرست داده‌ها در بخش سرور DHCP این دستگاه‌ها است. مهاجمان می‌توانند بدون نیاز به احراز هویت یا تعامل کاربر، تنها با ارسال بسته‌های DHCP دستکاری‌شده در همان شبکه محلی، این سرریز را فعال کرده و دیمون DHCP را از کار بیندازند یا حتی امکان اجرای کد از راه دور (remote code execution) را روی دستگاه‌های هدف به دست آورند.
Post summary
The text announces a high-severity D-Link vulnerability, states that a public PoC exists, provides technical vulnerability details, and notes that no patch is available yet.
2103751.7K
20.3K followersView on X
elhacker.NET@elhackernet30d
Disclosure
Router D-Link con fallo crítico exploitable remotamente sin autenticación D-Link Systems está investigando una vulnerabilidad de seguridad crítica en su router DIR-822A (CVE-2026-86296) https://blog.elhacker.net/2026/09/router-d-link-con-fallo-critico.html
Post summary
The text briefly announces CVE-2026-86296, a critical unauthenticated remote vulnerability in D-Link DIR-822A, pointing to a blog post for further details. No PoC, exploit, patch, or active exploitation evidence is provided in the text itself.
1411844.6K
142.5K followersView on X
Dark Web Intelligence@DailyDarkWeb30d
PoC
🚨 D-LINK DIR-822A CRITICAL FLAW — UNAUTH STACK OVERFLOW VIA DHCP (CVE-2026-86296), PUBLIC POC, NO PATCH YET D-Link has published security bulletin SAP10516 for a critical stack-based buffer overflow in the DIR-822A (Non-US) router’s udhcpcd DHCP component, and says a public proof-of-concept has been reported. No firmware fix is available yet — status remains Under Investigation. • CVE-2026-86296 — CVSS 10.0 Critical (vendor-cited CVE scoring) • Product: DIR-822A firmware A_101 (Non-US); hardware revision still under confirmation • Flaw: unbounded strcpy in udhcpcd/serverpacket.c while parsing DHCP / TR-111 Option 125 • Unauthenticated, no user interaction; network attack vector per the CVE record • Successful exploitation may cause memory corruption and can impact confidentiality, integrity, and availability (crash or potential RCE on the device) • Public PoC reported; D-Link has not released a security update as of the 21 Sep 2026 bulletin update • Same bulletin also tracks a second DIR-822A issue under investigation: CVE-2026-86510 (L2TP tunnel_set_params out-of-bounds write) • Researcher credit: tian (acknowledged by D-Link) ⚠️ Analyst Note: DHCP parsing is typically reachable from the LAN / adjacent segment (including guest or open Wi-Fi), so internet-wide remote exposure may be lower than a raw AV:N CVSS string suggests — but any untrusted device on the same broadcast domain can still reach the service. This is an official vendor acknowledgement of an unpatched critical router flaw with a reported public PoC, not confirmation of mass in-the-wild exploitation. Confirm exact model, hardware revision, and firmware before acting; install only D-Link firmware intended for that revision when a fix ships. Until then: keep the device off unnecessary internet exposure, restrict remote management, and limit who can hit the LAN DHCP path. Original D-Link security bulletin (SAP10516): https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10516 #DLink #DIR822A #CVE202686296 #RouterSecurity #ZeroDay #IoT #CyberSecurity #ThreatIntel #DDW #DarkWeb
Post summary
D‑Link disclosed a critical stack‑based buffer overflow (CVE‑2026‑86296) in DIR‑822A routers with a publicly released proof‑of‑concept and CVSS 10.0, but no patch is currently available.
210826.9K
209.0K followersView on X
Ryx@PadhiyarRushi27d
PoC
DIR-822A DHCP "strcpy" is CVSS 10.0. No patch. Public PoC is out!!!! CVE-2026-86296: LAN attacker sends a crafted DHCP packet. "udhcpcd/serverpacket.c" copies into a stack buffer with "strcpy". Crash or RCE, no auth, no click. Companion bug CVE-2026-86510 is an OOB write in "tunnel_set_params" on the L2TP path. Firmware A_101: D-Link SAP10516 still says under investigation. https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10516 #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #IoT #Router #RCE
Post summary
The post discloses a critical unauthenticated RCE vulnerability in D-Link DIR-822A (CVE-2026-86296) with CVSS 10.0, emphasizes that a public PoC has been released, and notes that no patch is currently available.
00083643
954 followersView on X
zoomeyebot@zoomeyebot30d
PoC
🚨 D-Link DIR-822A Routers Expose Critical DHCP and L2TP Flaws With Public PoC Critical Vulnerability Alert! D-Link DIR-822A firmware A_101 is affected by CVE-2026-86296. 🔍 Identify Targets via ZoomEye: Filter: title="DIR-822" Search Dork: app="D-Link Router" Exposure: 65.8k instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJELUxpbmsgUm91dGVyIg%3D%3D #DLink #CVE202686296 #RouterSecurity #BufferOverflow #Vulnerability
Post summary
This alert announces a critical BufferOverflow and L2TP flaw in D-Link DIR-822A firmware A_101 (CVE-2026-86296), highlighting the existence of a public PoC and providing ZoomEye-based target enumeration. It does not provide exploit code, report active exploitation, or offer a patch.
0001244
24 followersView on X
ねこさん⚡(ΦωΦ)@catnap70730d
Disclosure
D-Link DIR-822A Router Hit by CVSS 10.0 Flaw Exploitable Remotely Without Authentication https://cyberpress.org/d-link-dir-822a-router-hit-by-cvss-10-0-flaw/"The flaw, tracked as CVE-2026-86296, carries a maximum CVSS v3.1 severity rating of 10.0 and is linked to a stack-based buffer overflow in the router’s udhcpcd…"
Post summary
The text discloses a CVSS 10.0 stack-based buffer overflow vulnerability (CVE-2026-86296) in the D-Link DIR-822A router's udhcpcd component, providing technical details but no evidence of active exploitation or remediation steps.
11000244
3.5K followersView on X
Daily CyberSecurity@Daily_CyberSec29d
Disclosure
Discover the critical CVE-2026-86296 vulnerability in D-Link DIR-822A routers. Learn how this DHCP flaw allows attackers to execute arbitrary code locally. #DLink #RouterSecurity #CVE #CyberSecurity #TechNews https://meterpreter.org/dlink-dir-822a-router-vulnerability/
Post summary
The text announces the discovery of CVE-2026-86296, a critical DHCP flaw in D-Link DIR-822A routers enabling local arbitrary code execution, and directs readers to an external analysis link without mentioning patches, exploits, or active exploitation.
00001385
13.0K followersView on X
TwitGri@TwitGri30d
PoC
⚠️ D-Link DIR-822A : CVE-2026-86296 (CVSS 10) permet une RCE sans authentification. PoC public, aucun correctif disponible et pas d’exploitation connue à ce stade. Isolez l’équipement, coupez la gestion distante et surveillez l’avis D-Link. #Cyber #CVE
Post summary
The tweet discloses a critical unauthenticated RCE (CVE-2026-86296) in D-Link DIR-822A with a public PoC, no vendor patch available, and no known active exploitation, advising immediate isolation and disabling of remote management.
0001047
36 followersView on X
ねこさん⚡(ΦωΦ)@catnap70730d
Disclosure
D-Link Router Hit by CVSS 10.0 Flaw Exploitable Remotely Without Authentication https://cybersecuritynews.com/d-link-router-hit-by-cvss-10-0-flaw/ "D-Link Systems has disclosed that it is investigating a critical security vulnerability in its DIR-822A router, tracked as CVE-2026-86296."
Post summary
The text reports the disclosure of a critical CVSS 10.0 vulnerability (CVE‑2026‑86296) in D‑Link DIR‑822A routers that is remotely exploitable without authentication.
01000214
3.5K followersView on X
ExploitGrid@exploitgrid44d
Disclosure
[CVE] CVE-2026-86296 [HIGH PRIORITY] #D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflow 🔗 https://exploitgrid.net/cve/CVE-2026-86296
Post summary
This post discloses a stack‑based buffer overflow in the D‑Link DIR‑822A udhcpcd component, provides a link to additional resources, but omits exploitation or patch details.
1000023
41 followersView on X
ExploitGrid@exploitgrid44d
General
🛡️ #ExploitGrid Daily Threat Digest Top #Vulnerabilities (#CVEs) of the day CVE-2026-44756 CVE-2026-75650 CVE-2026-86296 CVE-2026-18922 CVE-2026-58240 ..🧵👇
Post summary
The tweet merely lists several CVEs without providing any additional context, technical details, or actionable information.
10000110
41 followersView on X
iototsecnews@iototsecnews23d
PoC
D-Link DIR-822A の脆弱性 CVE-2026-86296：CVSS 10.0 と公開 PoC に要注意 https://iototsecnews.jp/2026/09/22/d-link-dir-822a-router-vulnerability-scores-cvss-10-0-with-public-poc-available/ D-Link の DIR-822A ルーターにおける深刻なスタック・バッファ・オーバーフローなどの脆弱性 CVE-2026-86296／86510 について解説する記事です。エッジ・デバイスのメモリ安全性欠陥がリモートからの悪用リスクをもたらす背景があります。影響として、システムの機密性や完全性、可用性の重大な喪失が懸念されます。対応策として、製品バージョンの正確な確認／インターネット公開の停止／リモート管理サービスの制限／ファイアウォールの活用／公式ポータルの監視／慎重なファームウェアの適用が求められます。 #CVE202686296 #DLink #DIR822A #PoC #Vulnerability
Post summary
The text announces CVE-2026-86296 in D-Link DIR-822A routers with a CVSS 10.0 score and explicitly references a publicly available Proof of Concept, highlighting the stack-buffer-overflow vulnerability's memory safety defect and remote exploitation risk.
00000123
519 followersView on X
BT Haberler@BTHaberler27d
Disclosure
D-Link, Artık Desteklenmeyen DIR-822A Yönlendiricilerindeki İki Kritik Sıfır Günü İçin Yama Yayınlamayacağını Açıkladı! D-Link, kullanım ömrü sona ermiş DIR-822A çift bant yönlendiricilerini etkileyen iki kritik açık için uyarı yayınladı: CVE-2026-86296, DHCP sunucu bileşenindeki bir stack overflow açığı olup yerel ağdaki bir saldırganın özel hazırlanmış bir DHCP paketiyle hizmet dışı bırakma veya uzaktan kod çalıştırma sağlamasına izin veriyor; CVE-2026-86510 ise L2TP/L2TPv6 protokol ayrıştırıcısındaki bir "sınır dışı yazma" açığı. • Her iki açık için de kanıt niteliğinde çalışan istismar kodu (PoC) zaten kamuya açık, ancak cihazlar artık desteklenmediği için resmi bir yama gelmeyecek. • D-Link, kullanıcılara cihazları internetten erişilebilir bırakmamalarını ve yönetim erişimini kısıtlamalarını öneriyor. Bir üreticinin, kamuya açık istismar kodu bulunan kritik açıklar için "artık desteklenmiyor, kendiniz önlem alın" demesi, kullanım ömrü dolan ağ donanımlarının atılana kadar sessizce büyüyen, sahipsiz bir güvenlik riski biriktirdiğini gösteriyor. #SiberGüvenlik #DLink #SıfırGün
Post summary
D-Link announced it will not patch two critical zero-day vulnerabilities (CVE-2026-86296, CVE-2026-86510) affecting unsupported DIR-822A routers, noting that working exploit code is publicly available and advising users to limit device exposure.
0000048
43 followersView on X
セキュリティ対策Lab@securityLab_jp29d
Disclosure
D-Link DIR-822AにCVSS 10.0の脆弱性　CVE-2026-86296、認証不要で悪用可能なバッファオーバーフロー https://rocket-boys.co.jp/security-measures-lab/d-link-dir-822a-cve-2026-86296-report/ #セキュリティ対策Lab #security #securitynews #セキュリティ #セキュリティニュース
Post summary
The tweet discloses a critical (CVSS 10.0) unauthenticated buffer‑overflow vulnerability (CVE‑2026‑86296) in the D‑Link DIR‑822A, providing technical details but no PoC, exploit, patch, or indication of active exploitation.
00000167
718 followersView on X
General Intels Daily@intels_daily29d
PoC
🔴 𝗖𝗥𝗜𝗧𝗜𝗖𝗔𝗟 · 𝗢𝘁𝗵𝗲𝗿 🏢 Target: 𝗗-𝗟𝗶𝗻𝗸 🧩 Product: 𝗗-𝗟𝗶𝗻𝗸 𝗗𝗜𝗥-𝟴𝟮𝟮𝗔 🛡️ CVE-2026-86296, CVE-2026-86510 D-Link has issued a warning regarding a critical buffer overflow vulnerability (CVE-2026-86296) in DIR-822A routers, allowing unauthenticated remote code execution via DHCP packets. A PoC is available. A second vulnerability (CVE-2026-86510) in the L2TP parser is also under investigation. #ThreatIntel #CTI
Post summary
D-Link has issued a critical warning regarding two vulnerabilities in DIR-822A routers: CVE-2026-86296, a buffer overflow allowing una) unauthenticated remote code execution via DHCPue DPec a h packets with a PoC available, and CVE-2026-86510, an important L2TP parser issue under investigation.
00000134
727 followersView on X
Orion84@Orion84x30d
PoC
D-Link warned 22 Sep of CVE-2026-86296, a stack overflow in the DHCP server (udhcpcd) on legacy non-US DIR-822A firmware A_101. No authentication, public PoC and no fix because the model is end of support.
Post summary
The text discloses CVE-2026-86296 as a stack overflow in D-Link's DHCP server for legacy DIR-822A firmware, confirms a public PoC exists, but emphasizes no fix is available due to end-of-support status.
0000036
21 followersView on X
Aviatrix Threat Research Center@aviatrixtrc30d
Active Exploitation
TRC analysis shows attackers exploiting CVE-2026-86296 to achieve remote code execution on D-Link routers through crafted DHCP packets. Once compromised, routers become pivot points for lateral movement across internal networks. Runtime segmentation helps contain post-compromise activity when network gateways are breached. #ZeroDay 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/d-link-dir-822a-zero-day-cve-2026-86296-stack-overflow-2026
Post summary
The tweet reports active exploitation of CVE-2026-86296 (stack overflow) in D-Link routers via DHCP packets, emphasizing real-world attacks and technical attack vectors without mentioning patches or PoCs.
0000057
2.0K followersView on X
Vistem Solutions@VistemSolutions30d
General
Using a DIR-822A? Verify this CVE and affected firmware through D-Link’s official security advisories. Reduce exposure: ✅ Disable internet-facing router administration. ✅ Apply vendor-recommended security updates when available. ✅ Replace unsupported devices. Elevate your network security with Vistem Solutions. 📩 sales@vistem.com #Cybersecurity #VistemSolutions https://www.sentinelone.com/vulnerability-database/cve-2026-86296/?utm_source=in_page&utm_medium=Vistem+Solutions%2C+Inc.&utm_campaign=publer
Post summary
The text is a promotional post referencing CVE-2026-86296 (D-Link DIR-822A) via a SentinelOne vulnerability database link, offering generic security hygiene tips without specific technical details, PoC, named patches, or exploitation evidence.
0000020
90 followersView on X
Cybersecurity News Everyday@TweetThreatNews30d
PoC
D-Link flags a max-severity zero-day in legacy DIR-822A routers. CVE-2026-86296 is an unauthenticated stack-based buffer overflow in the DHCP server; public PoC exists. #DLink #DIR822A #CVE202686296 https://www.hendryadrian.com/d-link-warns-of-max-severity-zero-day-bug-in-dir-822a-routers/
Post summary
This tweet announces CVE-2026-86296, a stack-based buffer overflow in D-Link DIR-822A routers, explicitly noting that a public Proof of Concept exists. It provides technical details such as unauthenticated access and the affected DHCP service, but reports no active exploitation or available patch.
00000241
4.8K followersView on X
CyberPulse@CyberPulse5630d
PoC
‼️CRITICAL VULNERABILITY — D-Link DIR-822A D-Link has disclosed CVE-2026-86296, a CVSS 10.0 critical stack-based buffer overflow affecting the non-US DIR-822A router. The flaw is in the udhcpcd DHCP component and can be exploited without authentication or user interaction using specially crafted network requests. A public PoC has reportedly been published. A second issue, CVE-2026-86510, has also been reported as a critical memory-corruption vulnerability involving the L2TP control-message parser. Affected product: D-Link DIR-822A Reported firmware: A_101 CVE: CVE-2026-86296 Severity: Critical — CVSS 10.0 Attack requirement: Network access; no authentication required Patch: Under investigation / no confirmed security update at the time of D-Link’s advisory Active exploitation: No active exploitation reported by D-Link D-Link recommends not exposing affected routers unnecessarily to the Internet, disabling remote management where possible, and restricting administrative access to trusted systems while its investigation continues. #CyberSecurity #DLink #CVE202686296 #CVE202686510 #ZeroDay #RouterSecurity #VulnerabilityAlert
Post summary
The text discloses two critical D-Link router vulnerabilities (CVE-2026-86296 and CVE-2026-86510) with technical details, notes a public PoC is available, confirms no active exploitation, and provides mitigation workarounds while a patch is under investigation.
00000332
2.5K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-86296

Teegra 🧝‍♀️𝕏[verified]@TeeegraPoC

The text announces a high-severity D-Link vulnerability, states that a public PoC exists, provides technical vulnerability details, and notes that no patch is available yet.

Dark Web Intelligence[verified]@DailyDarkWebPoC

D‑Link disclosed a critical stack‑based buffer overflow (CVE‑2026‑86296) in DIR‑822A routers with a publicly released proof‑of‑concept and CVSS 10.0, but no patch is currently available.

Ryx[verified]@PadhiyarRushiPoC

The post discloses a critical unauthenticated RCE vulnerability in D-Link DIR-822A (CVE-2026-86296) with CVSS 10.0, emphasizes that a public PoC has been released, and notes that no patch is currently available.

zoomeyebot[verified]@zoomeyebotPoC

This alert announces a critical BufferOverflow and L2TP flaw in D-Link DIR-822A firmware A_101 (CVE-2026-86296), highlighting the existence of a public PoC and providing ZoomEye-based target enumeration. It does not provide exploit code, report active exploitation, or offer a patch.

BT Haberler[verified]@BTHaberlerDisclosure

D-Link announced it will not patch two critical zero-day vulnerabilities (CVE-2026-86296, CVE-2026-86510) affecting unsupported DIR-822A routers, noting that working exploit code is publicly available and advising users to limit device exposure.

セキュリティ対策Lab[verified]@securityLab_jpDisclosure

The tweet discloses a critical (CVSS 10.0) unauthenticated buffer‑overflow vulnerability (CVE‑2026‑86296) in the D‑Link DIR‑822A, providing technical details but no PoC, exploit, patch, or indication of active exploitation.

General Intels Daily[verified]@intels_dailyPoC

D-Link has issued a critical warning regarding two vulnerabilities in DIR-822A routers: CVE-2026-86296, a buffer overflow allowing una) unauthenticated remote code execution via DHCPue DPec a h packets with a PoC available, and CVE-2026-86510, an important L2TP parser issue under investigation.

Aviatrix Threat Research Center[verified]@aviatrixtrcActive Exploitation

The tweet reports active exploitation of CVE-2026-86296 (stack overflow) in D-Link routers via DHCP packets, emphasizing real-world attacks and technical attack vectors without mentioning patches or PoCs.