CVE-2026-90822 FatPipe Networks CVE debrief

Who should care

Defenders responsible for FatPipe MPVPN, WARP, and IPVPN appliances, including operators, platform administrators, vulnerability management teams, and security teams, should assess exposure and prioritize verification and remediation efforts to prevent potential exploitation of the OS command injection vulnerability.

Why it matters

CVE-2026-90822 is a critical OS command injection vulnerability in FatPipe MPVPN, WARP, and IPVPN appliances running end-of-life firmware version 10.1.2r60p100. Defenders should prioritize verifying exposure and restricting access to the management interface to prevent exploitation.

• Verify exposure of FatPipe MPVPN, WARP, and IPVPN appliances running firmware version 10.1.2r60p100
• Restrict access to the management interface to prevent unauthorized access
• Upgrade to a current supported release to prevent exploitation

Technical summary

CVE-2026-90822 FatPipe MPVPN, WARP, and IPVPN appliances running end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerability in the xtremed daemon. An unauthenticated remote attacker with access to the affected management interface can submit crafted input to the AuthFormServlet endpoint, causing authentication data to be processed by a shell and allowing arbitrary commands to execute as root.

Defensive priority

Defenders should prioritize verifying exposure of FatPipe MPVPN, WARP, and IPVPN appliances running firmware version 10.1.2r60p100 and restricting access to the management interface.

Recommended defensive actions

• Verify exposure of FatPipe MPVPN, WARP, and IPVPN appliances running firmware version 10.1.2r60p100
• Restrict access to the management interface to trusted administrative networks
• Use WAN access control lists to limit access to trusted sources
• Contact FatPipe Support for help confirming firmware version and upgrading to a current supported release
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and affected products. FatPipe recommends restricting management access to trusted administrative networks and using WAN access control lists to limit access to trusted sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.