Tenda AC9 Web Management Authentication Bypass Vulnerability

A flaw has been found in Tenda AC9 15.03.05.14. This impacts the function R7WebsSecurityHandler of the component Web Management. This manipulation causes improper authentication. The attack may be initiated remotely. The exploit has been published and may be used.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-86300 is an improper authentication flaw in Tenda AC9 15.03.05.14 affecting the R7WebsSecurityHandler component of the web management interface. This vulnerability allows remote attackers to bypass authentication controls without proper credentials, potentially granting unauthorized access to router configuration and management functions. Tenda AC9 routers are widely deployed in small office and home office (SOHO) environments, making this vulnerability particularly impactful for organizations relying on these devices for network access control and security.

Casky's 283 matching skills leverage Claude AI's extended reasoning to identify attack patterns associated with TA0004 (Privilege Escalation) and TA0006 (Credential Access) techniques. Practitioners using the platform would observe detection patterns for improper authentication validation in HTTP requests to the web management interface, anomalous access to administrative functions without proper session tokens, and attempts to manipulate or bypass authentication handlers. The skills map exploitation activity to CWE-287 authentication weaknesses, allowing security teams to correlate suspicious web management traffic, detect lateral movement attempts post-authentication bypass, and prioritize patching of Tenda AC9 devices in their network inventory before adversaries exploit this publicly disclosed vulnerability.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-86300.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-86300

Casky has 283 skills that investigate the attack patterns behind CVE-2026-86300. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn