[ CVE-2026-107795 · Published 14 Oct 2026 ]
Vulnerability in TP-Link Systems Inc. Omada Software Controller
CVSS 7.5
EPSS <1%No fix listed yet
[ Description ]Official description
Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations. Successful exploitation may allow a low-privileged authenticated user to upload or delete the controller's TLS certificate or private key, potentially disrupting secure management access.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.