OS Command Injection Vulnerability in FatPipe Appliances

CVE-2026-90822

What is CVE-2026-90822?

The vulnerability in FatPipe MPVPN, WARP, and IPVPN appliances running end-of-life firmware 10.1.2r60p100 involves an OS command injection risk associated with the xtremed daemon. Attackers can exploit this flaw if they gain access to the management interface, which requires activation by the user. By sending specially crafted input to the AuthFormServlet endpoint, an attacker can manipulate authentication data, leading to the execution of arbitrary commands with root privileges. It is critical for users to restrict management access and employ WAN access control lists to safeguard against unauthorized access.

References