OS Command Injection Vulnerability in FatPipe Appliances

CVE-2026-90822

What is CVE-2026-90822?

CVE-2026-90822 is an OS command injection vulnerability found in FatPipe Appliances, specifically affecting the MPVPN, WARP, and IPVPN models that run the deprecated firmware version 10.1.2r60p100. This vulnerability allows unauthenticated remote attackers to inject malicious commands through the management interface of the appliance, specifically targeting the AuthFormServlet endpoint. When exploited, this flaw enables attackers to execute arbitrary commands at the root level on the affected system. The severity of this vulnerability stems from the potential for attackers to gain complete control over the appliance, leading to unauthorized access to sensitive data, manipulation of configurations, and potentially larger breaches within the organization’s network.

Organizations using FatPipe appliances with the identified outdated firmware should be aware that the affected management interface is disabled by default. However, if it is enabled by the customer, it presents an entry point for attackers. Best practices recommend that management access is restricted to trusted networks, and users should utilize WAN access control lists to further mitigate risks.

Potential impact of CVE-2026-90822

1. Arbitrary Code Execution: The most significant impact of this vulnerability is the potential for attackers to execute arbitrary commands as a root user. This level of access allows attackers to manipulate the system, deploy additional malicious software, or abuse the appliance for further intrusions into the organization’s network.

2. Data Breach Risk: With root-level access, attackers can compromise sensitive data contained within the appliance. This may lead to unauthorized access and extraction of confidential information, potentially resulting in data breaches that can have severe implications for compliance and customer trust.

3. Network Integrity Threats: The ability for an attacker to manipulate configurations of critical network infrastructure can lead to integrity issues across the organization. Malicious changes could disrupt operations, reroute traffic, and create vulnerabilities that could be exploited for further cyberattacks, increasing the overall risk profile of the organization.

References