Is CVE-2026-27650 actively exploited?

CVE-2026-27650 has no public evidence of in-the-wild exploitation as of 2026-03-31.

What is the CVSS score for CVE-2026-27650?

CVE-2026-27650 has a CVSS score of 8.6 (HIGH severity). Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

How do I patch CVE-2026-27650?

Patch guidance is available from buffalo security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2026-27650.

Fix CVE-2026-27650 - HIGH buffalo wcr-1166dhpl firmware

Q: Which products are affected by CVE-2026-27650?

46 products: buffalo wcr-1166dhpl firmware, buffalo wsr3600be4-kh firmware, buffalo wsr3600be4p firmware, buffalo wxr-1750dhp firmware, buffalo wxr-1750dhp2 firmware, and 41 more.

Description

OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary OS command may be executed on the products.

CVSS Metrics

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector: network
Complexity: low
Privileges: none
User Action: active
Confidentiality: undefined
Integrity: undefined
Availability: undefined
Weaknesses: CWE-78 · OS Command Injection

Metadata

Primary Vendor: BUFFALO
Published: 3/27/2026
Last Modified: 3/31/2026
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

buffalo : wcr-1166dhpl_firmwarebuffalo : wsr3600be4-kh_firmwarebuffalo : wsr3600be4p_firmwarebuffalo : wxr-1750dhp_firmwarebuffalo : wxr-1750dhp2_firmwarebuffalo : wxr18000be10p_firmwarebuffalo : wxr-1900dhp_firmwarebuffalo : wxr-1900dhp2_firmwarebuffalo : wxr-1900dhp3_firmwarebuffalo : wxr-5950ax12_firmwarebuffalo : wxr-6000ax12b_firmwarebuffalo : wxr-6000ax12p_firmwarebuffalo : wxr-6000ax12s_firmwarebuffalo : wzr-1166dhp_firmwarebuffalo : wzr-1166dhp2_firmwarebuffalo : wzr-1750dhp_firmwarebuffalo : wzr-1750dhp2_firmwarebuffalo : wzr-s1750dhp_firmwarebuffalo : wrm-d2133hp_firmwarebuffalo : wrm-d2133hs_firmwarebuffalo : wtr-m2133hp_firmwarebuffalo : wtr-m2133hs_firmwarebuffalo : wem-1266_firmwarebuffalo : wem-1266wp_firmwarebuffalo : vr-u300w_firmwarebuffalo : vr-u500x_firmwarebuffalo : wapm-1266r_firmwarebuffalo : wapm-1266wdpr_firmwarebuffalo : wapm-1266wdpra_firmwarebuffalo : wapm-1750d_firmwarebuffalo : wapm-2133r_firmwarebuffalo : wapm-2133tr_firmwarebuffalo : wapm-ax4r_firmwarebuffalo : wapm-ax8r_firmwarebuffalo : wapm-axetr_firmwarebuffalo : waps-1266_firmwarebuffalo : waps-ax4_firmwarebuffalo : fs-m1266_firmwarebuffalo : fs-s1266_firmwarebuffalo : wzr-600dhp_firmwarebuffalo : wzr-600dhp2_firmwarebuffalo : wzr-600dhp3_firmwarebuffalo : wzr-900dhp_firmwarebuffalo : wzr-900dhp2_firmwarebuffalo : wzr-s600dhp_firmwarebuffalo : wzr-s900dhp_firmware

Remediation Guidance

Executive Summary

View on NIST NVD