CVE-2026-107795

CVSS 7.5 (high) · published 2026-10-14

Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations.  Successful exploitation may allow a low-privileged authenticated user to upload or delete the controller's TLS certificate or private key, potentially disrupting secure management access.

Weakness: CWE-284, CWE-862

Source: NVD CVE-2026-107795

References

• https://support.omadanetworks.com/en/download/software/omada-controller/
• https://support.omadanetworks.com/us/document/136188/
• https://support.omadanetworks.com/us/download/software/omada-controller/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.