# CVE-2026-121615: Linksys E5600 Login mesh_login.cgi improper authentication

- Exploited (CISA KEV): no
- Published: 2026-11-04
- CVSS: 10 CRITICAL (v4.0)
- EPSS: no score
- CWE: CWE-287

A vulnerability was determined in Linksys E5600 1.1.0.26. Affected is an unknown function of the file /cgi-bin/mesh_login.cgi of the component Login Handler. Executing a manipulation can lead to improper authentication. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | No public claim | — | — |
| Vercel | No public claim | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Social

10 posts seen since 2026-11-04.

- bluesky 2026-11-04: 🔴 CVE-2026-121615 - Critical (10)  A vulnerability was determined in Linksys E5600 1.1.0.26. Affected is an unknown function of the ...  https://www.thehackerwire.com/vulnerability/CVE-2026-121615/  #infosec #cybersecurity #CVE #vulnerability #security #patchstack (https://bsky.app/profile/thehackerwire.bsky.social/post/3mzhnqyyyee2l)
- mastodon 2026-11-04: 🔴 CVE-2026-121615 - Critical (10) A vulnerability was determined in Linksys E5600 1.1.0.26. Affected is an unknown function of the file /cgi-bin/mesh_login.cgi of the component Login Handler. Executing a manipulation can lead to improper authentication. The attack can be launch… (https://mastodon.social/@thehackerwire/117556595285818405)
- bluesky 2026-11-04: CVE-2026-121615 The login page on Linksys E5600 routers (firmware version 1.1.0.26) contains a flaw that lets an attacker bypass authentication from a remote location. This could let an unauthorized person gain access to the…  Too many irrelevant or confusing CVEs? Use stackflag… (https://bsky.app/profile/stackflag.bsky.social/post/3mzhissx42322)
- x 2026-11-04: 🆕 New CVE: CVE-2026-121615 (CVSS 10.0) Linksys E5600 · Authentication bypass Remote, no login needed.  A vulnerability was determined in Linksys E5600 1.1.0.26.  https://t.co/2AL8rhGvUe (https://x.com/EnclaveRadar/status/2117833164693356817)
- bluesky 2026-11-04: 🚨 CVE-2026-121615 — CVSS 9.3 CRITICAL  A vulnerability was determined in Linksys E5600 1.1.0.26. Affected is an unknown function of the file /cgi-...  🔎 https://stemshop.top/cve/CVE-2026-121615  #CVE #CyberSecurity #InfoSec (https://bsky.app/profile/stemshop.bsky.social/post/3mzhi5m6lnw2v)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-121615 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-121615