Vulnerability in TP-Link Systems Inc. Archer Mr600

CVE-2026-76653

A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials. Successful exploitation may allow a remote unauthenticated attacker to disclose and modify VPN configuration information.

Published · last modified .

EPSS exploit prediction

EPSS: 0.005 (40.7th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 41st percentile — 40.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-76653: held from 0.005 to 0.005.

EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000

Affected products

Weakness classification (CWE)

References