CVE-2026-57920

HighCVSS 7.7

Published: 26/06/2026(UTC)Updated: 02/07/2026(UTC)Translated: 03/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile — higher than 12% of all known CVEs

Summary

A vulnerability in Peplink InControl 2 up to version 2.14.2 before 2026-06-03 allows bypassing access-control rules for certain /rest/o/{orgId} endpoints by using a semicolon.

Risk Assessment

An attacker can gain unauthorized access to sensitive organizational data, potentially leading to confidentiality and integrity breaches.

Recommendation

Immediately upgrade Peplink InControl 2 to version 2.14.3 or later, available after 2026-06-03.

Original NVD description (English source)

Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} endpoints.