CVE-2026-111712
Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected
CVSS
6.5
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 16, 2026 · Last modified: Oct 16, 2026 · CWE-288
Not enough EPSS history yet.
Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7_web_auth.cgi or an .ico route to invoke protected management handlers without credentials.
- github.comhttps://github.com/lukadqq/netcore-router-public-refs/blob/a44d562736b41c944223297e9144d2ad7fa2aff1/2026.10.15-netcore-nr256cn-cgi-auth-bypass-alternate-path.md
- www.vulncheck.comhttps://www.vulncheck.com/advisories/netcore-nr256cn-through-1.5.140116-authentication-bypass-via-cgi-path-prefix
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-890576.8 MED—
———A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.5hCVE-2026-19863—44.2%
——13An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path.
This is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within a protected request path, the request may be treated as the login page and its authentication or role requirement replaced with ALLOWED.
Exploitation requires the protected resource path to contain the configured login path as a later segment. Explicitly FORBIDDEN routes are not affected.1dCVE-2026-110852—27.6%
——8n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit this identifier in requests to webhook, form, or MCP routes to execute workflows in unrelated projects under those projects' credentials.1dCVE-2026-890678.8 HIG45.1%
——14Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.1dCVE-2026-858655.5 MED19.9%
——6Improper authentication in Windows DHCP Server allows an authorized attacker to bypass a security feature locally.3dCVE-2026-837875.5 MED19.9%
——6Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker to bypass a security feature locally.2d