VulnerabilityAwaiting Analysis

CVE-2026-32326

SHARP routers do not perform authentication for some web APIs.

MEDIUM 6.9EPSS 0.28%

Does this matter?

Lower severity and a low EPSS score (0.28%). Track it; it rarely justifies an emergency change on its own.

Description

SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password of the device is left as the initial one, the device may be taken over.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.28% probability · 20th percentile
CISA KEV: Not listed
Weakness: CWE-306
Source: vultures@jpcert.or.jp

References

https://global.sharp/corporate/info/product-security/advisory-list/2026-002/
https://jvn.jp/en/jp/JVN49524110/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.