CVE-2026-49186 is a critical authentication flaw (CVSS 9.8) in the Acer Connect M6E 5G. Its local MQTT broker does not enforce topic level access control lists, so any client can subscribe with wildcards or publish rogue control commands. Install the firmware update named in Acer article 19707.
What's affected
Acer Connect M6E 5G and its firmware, as listed in the record, with no firmware versions given. Read Acer's knowledge base article 19707 for the affected and fixed firmware.
The description says any client can subscribe with wildcard characters to list hidden network devices, or publish control commands. The vector is network based, with no privileges needed.
How to check if you're exposed
Find Acer Connect M6E 5G units in use, including spares and field devices. Read the firmware version in the device admin page and compare it with the fixed firmware named in Acer's article 19707.
The Acer page was protected by a browser check and did not load for our review, so read it directly for the fixed firmware version.
Also check which networks can reach the device's MQTT port.
What to do now
- Find all Acer Connect M6E 5G devices and note their firmware versions.
- Read Acer article 19707 and install the fixed firmware it names.
- Keep the device management and local services off untrusted networks until the update is applied.
- If the device cannot be updated, consider replacing it, and change any credentials that were stored on it.
Why it matters
The class is CWE-287, improper authentication. An MQTT broker routes messages by topic, and access lists decide which client may read or write which topic. With none enforced, every connected client has the same rights, including to topics that control the device.
The record points out two effects: finding devices that were meant to be hidden, and sending commands. Brokers on small devices are often set up for convenience, so asking whether yours has per topic rules is a useful audit question. The record does not mark this CVE as exploited, and it is not on the CISA Known Exploited Vulnerabilities list.
There is no package manifest to scan for this one, so inventory comes first. List every host, instance or device running an affected build. The Gold directory page for CVE-2026-49186 is a handy place to follow later updates.
Quick check
What does a topic wildcard do?
It subscribes a client to many topics at once. Without access lists, one client can see everything the broker carries.
Sources
Last reviewed: 19 October 2026.
