What is CVE-2026-15427?

CVE-2026-15427 is a high-severity vulnerability in TP-Link Archer Vx1800v, classified under OS Command Injection. CVSS score: 8.1/10. Published 2026-07-14.

How severe is CVE-2026-15427?

High severity. CVSS v3 base score is 8.1 out of 10.

RCE in TP-Link Archer Vx1800v

CVE-2026-15427

An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitization of parameters, allowing crafted input to be executed as system-level commands. Exploitation requires specific conditions such as TR-069 being enabled and ability to influence ACS-delivered commands, compromise or control an ACS server. Successful exploitation may allow arbitrary command execution with root privileges, resulting in complete compromise of the device.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.006 (43.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Tp-link Archer_vx1800v — versions 1.0
Tp-link Archer_vx1800v_firmware — versions 2.0.0
Tp-link Systems Inc. Archer Vx1800v V1 — versions 0

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

f23511db-6c3e-4e32-a477-6aa17d310630 (Product, patch)
f23511db-6c3e-4e32-a477-6aa17d310630 (vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2026-15427?: CVE-2026-15427 is a high-severity vulnerability in TP-Link Archer Vx1800v, classified under OS Command Injection. CVSS score: 8.1/10. Published 2026-07-14.
How severe is CVE-2026-15427?: High severity. CVSS v3 base score is 8.1 out of 10.