D-Link DIR-822A Maximum Severity Zero-Day Vulnerability

CVSS 10.0 vulnerability in D-Link DIR-822A legacy routers with public PoC and no patch. Device is end-of-life; D-Link recommends replacement.

cat cve-2026-86296.json

Vendor: D-Link
Product: DIR-822A
CVSS: 10.0
EPSS (exploit probability): 1.3%
Status: unpatched
Published: September 22, 2026
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-86296

CVE-2026-86296 affects the D-Link DIR-822A dual-band Wi-Fi router. D-Link has disclosed the flaw directly to customers and confirmed that no patch will be issued: the DIR-822A is past end of life.

Severity: CVSS 10.0 (Critical) per NVD.

Exploitation status: Public proof-of-concept exploit code is in circulation as of September 2026. No patch is available or planned. D-Link recommends replacing the device.

Recommended action: Treat this as a hardware replacement priority. If immediate replacement is not possible, do not expose the router directly to the internet. Place it behind a firewall and restrict external access until a replacement is in place.

For full coverage see D-Link Warns CVSS 10.0 DIR-822A Flaw Has No Fix.

Related coverage

~/articles/2026-09-23-d-link-dir-822a-cve-2026-86296-no-patch

d link

D-Link Warns CVSS 10.0 DIR-822A Flaw Has No Fix

CVE-2026-86296: CVSS 10.0 D-Link DIR-822A zero-day with public PoC exploit code and no patch. D-Link says the device is end-of-life and replacement is needed.

Sep 23read →