D-Link Warns CVSS 10.0 DIR-822A Flaw Has No Fix

D-Link has warned customers of CVE-2026-86296, a CVSS 10.0 vulnerability in the legacy DIR-822A dual-band Wi-Fi router. No patch is available, and public proof-of-concept exploit code is already in circulation. The NVD record has the technical specifics; BleepingComputer confirmed D-Link’s advisory and the PoC’s availability.

A CVSS 10.0 is the highest score the scoring system can assign. A public PoC with no patch is approximately the worst position a device can be in.

No patch is coming

The DIR-822A is an older device, and D-Link has classified it as past end of life. For EOL hardware, the standard vendor response to a critical flaw is no longer a patch: it’s a recommendation to replace the device. That is where this one sits.

Users still running DIR-822A routers should treat this as a replacement deadline rather than a patching event. The device should not be internet-facing until it is replaced. If immediate replacement is not possible, placing the router behind a firewall and restricting internet exposure reduces the attack surface while a replacement is sourced.

Why PoC availability matters here

A public PoC for an unpatched router vulnerability removes the expertise barrier for attackers. Routers are also frequently the devices that receive the least maintenance attention in a home or small business environment; default credentials, years without firmware updates, and no managed patching cadence are common. CVE-2026-86296’s combination of factors, CVSS 10.0, no patch, and a public PoC on an EOL device, moves it into the category of active near-term risk rather than theoretical future concern.

Context

D-Link hardware has had a recurring presence in unpatched-critical-flaw disclosures across 2026. Earlier this month, three command injection vulnerabilities in D-Link DWR series routers were disclosed, affecting a different but similarly positioned product class. The pattern for older D-Link models is consistent: critical flaws, aging install bases, and limited or absent patching for devices the company has moved past.

For the DIR-822A, the answer is a hardware refresh. The vulnerability is not going away, and the PoC makes that timeline more urgent than it might otherwise be.