CVE-2026-90823 FatPipe Networks CVE debrief

Who should care

Defenders responsible for FatPipe MPVPN, WARP, and IPVPN appliances should assess exposure and prioritize upgrading to a current supported firmware release. They should also restrict management access to trusted administrative networks and use WAN access control lists to limit access to trusted sources. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-90823 FatPipe MPVPN, WARP, and IPVPN appliances running end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow vulnerability. Defenders should prioritize upgrading to a current supported firmware release and restrict management access to trusted administrative networks.

• Potential arbitrary code execution as root
• Unauthenticated remote attacker access to management interface
• Need to upgrade to a current supported firmware release
• Restrict management access to trusted administrative networks

Technical summary

CVE-2026-90823 FatPipe MPVPN, WARP, and IPVPN appliances running end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow vulnerability in /usr/sbin/auth_user_pass. An unauthenticated remote attacker with access to the affected management interface can submit a crafted authentication request, potentially allowing arbitrary code execution as root. The affected management interface is disabled by default and must be affirmatively enabled by the customer before the endpoint becomes reachable. Defenders should prioritize upgrading to a current supported firmware release and restrict management access to trusted administrative networks.

Defensive priority

Defenders should prioritize upgrading to a current supported firmware release and restrict management access to trusted administrative networks.

Recommended defensive actions

• Upgrade to a current supported firmware release
• Restrict management access to trusted administrative networks
• Use WAN access control lists to limit access to trusted sources
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability and affected firmware version. The vulnerability affects FatPipe MPVPN, WARP, and IPVPN appliances running end-of-life firmware version 10.1.2r60p100. Defenders should verify the firmware version of their appliances and assess exposure. The CVE Program and NVD provide additional information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.