CVE-2026-49185 is a critical command injection flaw (CVSS 9.8) in the Acer Connect M6E 5G router. The FieldX MDM adb messaging topic passes unverified payloads straight into Runtime.exec(). Acer's knowledge base article 19707 is the vendor reference, so install the firmware update it names.
What's affected
Acer Connect M6E 5G and its firmware, as listed in the record. The record names no firmware versions. Acer's knowledge base article 19707 is the reference for affected and fixed firmware.
The vector is network based with no privileges and no user interaction.
How to check if you're exposed
Find Acer Connect M6E 5G units in use, including spares and field devices. Read the firmware version in the device admin page and compare it with the fixed firmware named in Acer's article 19707.
The Acer page was protected by a browser check and did not load for our review, so read it directly for the fixed firmware version.
What to do now
- Find all Acer Connect M6E 5G devices and note their firmware versions.
- Read Acer article 19707 and install the fixed firmware it names.
- Keep the device management and local services off untrusted networks until the update is applied.
- If the device cannot be updated, consider replacing it, and change any credentials that were stored on it.
Why it matters
The class is CWE-78, OS command injection. A messaging topic accepts payloads and hands them to a function that runs commands, without checking what they contain. Anyone able to publish to that topic could therefore cause the device to run commands.
Two more flaws were published for the same device on the same day, CVE-2026-49186 and CVE-2026-49188, so the three should be handled together. Edge devices are a good example of why firmware inventory matters, since they rarely appear in package based scanners. The record does not mark this CVE as exploited, and it is not on the CISA Known Exploited Vulnerabilities list.
There is no package manifest to scan for this one, so inventory comes first. List every host, instance or device running an affected build. The Gold directory page for CVE-2026-49185 is a handy place to follow later updates.
Quick check
Can a software scanner find this?
Not usually. It is device firmware, so it needs an asset inventory.
Sources
Last reviewed: 19 October 2026.
