CVE-2026-11730Insufficient session randomness vulnerability exists in certain NETGEAR EX Series Models

Description

Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• https://www.netgear.com/support/product/ex3700 productpatch
• https://www.netgear.com/support/product/ex6120 productpatch
• https://kb.netgear.com/000070958/October-2026-NETGEAR-Security-Advisory vendor-advisorypatch