CVE-2026-26792 is a critical (CVSS 9.8) command injection in the set_upgrade function of GL-iNet GL-AR300M16 firmware v4.3.11. The record lists seven vulnerable parameters. It names no fixed version, so check GL-iNet's firmware page for a patched release and keep the router's management interface off untrusted networks until you find one.
What's affected
The record names the GL-iNet GL-AR300M16 router and its firmware, version 4.3.11. It lists the modem_url, target_version, current_version, firmware_upload, hash_type, hash_value and upgrade_type parameters of set_upgrade as injectable.
The record gives no fixed version and its only reference is a third party write up on GitHub. Treat other firmware versions as unconfirmed until GL-iNet says otherwise.
How to check if you're exposed
Open the router's admin panel and read the firmware version on the system or upgrade page. If it shows 4.3.11, you are in the affected set named by the record.
Then ask a second question: who can reach the admin interface? The CVSS vector is network based with no privileges and no user interaction, so any route from an untrusted network to the management interface counts as exposure.
What to do now
- Confirm the firmware version on each AR300M16 you run.
- Block access to the admin interface from the internet and from guest or untrusted networks.
- Check GL-iNet's official firmware downloads and advisories for a version that addresses this CVE, and apply it once confirmed.
- Look at router logs for unexpected upgrade requests, and rotate the admin password after patching.
- Add the device to your asset inventory so the next router CVE does not start with a hunt.
Why it matters
The weakness is CWE-77, command injection. Input from a request is placed into a command that the device runs, without being neutralized first. On a router the command runs with high privilege, which is why the record scores confidentiality, integrity and availability impact as high.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog. Small network devices often sit unpatched for long periods, so a critical flaw in an upgrade routine deserves attention even without that flag.
Quick check
Is a fixed version confirmed?
The record names none. Check the vendor's firmware page and advisories before you assume a fix exists.
Sources
- CVE-2026-26792 on Gold
- NVD record for CVE-2026-26792, published 12 March 2026
- Third party write up listed in the record: https://github.com/sezangel/IOT-vul/tree/main/GL-iNet/GL-AR300M16/set_upgrade
Last reviewed: 19 October 2026.
