CVE-2026-9216: Insufficient input validation vulnerability exists in certain NETGEAR RAX Models

Published Sep 8, 2026

Updated

An insufficient input validation vulnerability in the listed NETGEAR RAX series models allows a network-adjacent attacker having network access (such as WiFi credentials) to crash the router's management UI. There is no confidentiality or integrity impact. A crash of the router's management UI does not impact the availability of the router's core services like WiFi network.

Affected Software

1 affected component

Netgear RAX series routers

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade NETGEAR RAX30 Nighthawk AX5 5-Stream AX2400 WiFi 6 Router to a version that resolves this vulnerability.
Fixed in V1.0.9.92
Upgrade
Upgrade NETGEAR RAX35 Nighthawk AX4 4-Stream WiFi 6 Router to a version that resolves this vulnerability.
Fixed in V1.0.10.72
Upgrade
Upgrade NETGEAR RAX38 Nighthawk AX4 4-Stream AX3000 WiFi Router to a version that resolves this vulnerability.
Fixed in V1.0.6.106
Upgrade
Upgrade NETGEAR RAX40 Nighthawk AX4 4-Stream WiFi Router to a version that resolves this vulnerability.
Fixed in V1.0.6.106
Upgrade
Upgrade NETGEAR RAXE300 Nighthawk AXE7800 Tri-Band WiFi 6E Router to a version that resolves this vulnerability.
Fixed in V1.0.10.72
Compensating control
For devices marked (EoS) (RAX38 and RAX40), there are no security updates planned; retire the devices and upgrade to a newer NETGEAR device for continued security support.

Event History

Sep 8, 2026

CVE Published

via MITRE·05:09 PM

Data Sourced

via MITRE·05:09 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·06:21 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be network-adjacent and have network access to the router, such as WiFi credentials. The available information does not indicate that an unauthenticated internet-based attacker can exploit it.

What is the operational impact if exploitation succeeds?

Exploitation can crash the router's management UI. The vulnerability has no confidentiality or integrity impact, and the crash does not affect core router services such as the WiFi network.

Which products should be reviewed?

Review NETGEAR RAX series routers, particularly the RAX30, RAX35, and RAX38 models identified in the available product references.