Is CVE-2026-18599 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-18599?

CVE-2026-18599 has a CVSS v3 severity of HIGH (8).

Back

CVE-2026-18599

Description

A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC Plugin. This manipulation of the argument record_size causes command injection. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.