CVE-2026-90822: FatPipe MPVPN OS Command Injection Flaw

CVE-2026-90822 Overview

CVE-2026-90822 is an operating system command injection vulnerability affecting FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100. The flaw resides in the xtremed daemon and is reachable through the AuthFormServlet endpoint on the management interface. An unauthenticated remote attacker can submit crafted authentication input that a shell interprets, resulting in arbitrary command execution as root. The management interface is disabled by default and must be enabled by the customer for the endpoint to be reachable. The vulnerability is tracked under CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
Unauthenticated remote attackers with reachability to the management interface can execute arbitrary commands as root, resulting in full appliance compromise.

Affected Products

FatPipe MPVPN appliances running firmware 10.1.2r60p100
FatPipe WARP appliances running firmware 10.1.2r60p100
FatPipe IPVPN appliances running firmware 10.1.2r60p100

Discovery Timeline

2026-09-17 - CVE-2026-90822 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-90822

Vulnerability Analysis

The vulnerability exists in the xtremed daemon that services the management interface on FatPipe MPVPN, WARP, and IPVPN appliances. The AuthFormServlet endpoint accepts authentication data from remote clients without adequate neutralization of shell metacharacters. Because the daemon passes attacker-controlled input to a shell during authentication processing, crafted payloads break out of the intended context and execute as root. Successful exploitation grants full control over the appliance, including network traffic inspection, configuration modification, credential theft, and use of the device as a pivot into internal networks.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. Authentication data submitted to AuthFormServlet is concatenated into a shell command line rather than passed to a process as discrete arguments. Shell metacharacters supplied by the attacker are interpreted rather than treated as literal input, enabling command injection.

Attack Vector

Exploitation requires network reachability to the affected management interface on the appliance. The attack does not require authentication, user interaction, or prior privileges on the target. The attacker submits an HTTP request to the AuthFormServlet endpoint containing crafted authentication input that includes shell metacharacters. The xtremed daemon processes the input through a shell, and the injected command runs with root privileges. The affected management interface is disabled by default; only appliances where the customer has affirmatively enabled the interface are exposed. Additional details are available in the Securifera Security Advisories.

Detection Methods for CVE-2026-90822

Indicators of Compromise

Unexpected HTTP POST requests to the AuthFormServlet endpoint on the appliance management interface, particularly requests containing shell metacharacters such as ;, |, `, $(, or && in authentication fields.
New or unexpected processes spawned by the xtremed daemon, especially shells (sh, bash) or network utilities (curl, wget, nc).
Outbound network connections from the appliance to untrusted hosts following management-interface activity.
Modifications to appliance configuration, cron jobs, or on-disk binaries that cannot be attributed to authorized administrative activity.

Detection Strategies

Inspect web access and application logs on affected appliances for requests to AuthFormServlet with anomalous payload structure or non-standard authentication field content.
Correlate management-interface HTTP requests with process creation events on the appliance to identify shell activity spawned from xtremed.
Monitor perimeter and internal network flows for connections originating from the appliance to unexpected destinations, protocols, or ports.

Monitoring Recommendations

Forward appliance logs and network telemetry to a centralized analytics platform for retention and correlation.
Alert on any external source addresses reaching the management interface, since access should be limited to trusted administrative networks.
Baseline normal administrative traffic patterns to the management interface so that deviations trigger investigation.

How to Mitigate CVE-2026-90822

Immediate Actions Required

Contact FatPipe Support to confirm the running firmware version and to plan an upgrade to a currently supported release using the FatPipe Support Page, support@fatpipeinc.com, or +1 800-724-8521 (option 3).
Disable the appliance management interface if it is not required for operations.
Restrict management-interface access to trusted administrative networks using WAN access control lists.
Review appliance logs and process activity for signs of prior exploitation before applying mitigations.

Patch Information

The affected firmware version 10.1.2r60p100 is end-of-life. FatPipe directs customers to contact support for assistance in identifying their firmware version and upgrading to a current supported release. Refer to the FatPipe Support Page for engagement details.

Workarounds

Ensure the management interface remains disabled unless actively required, since the endpoint is not reachable by default.
Apply WAN access control lists that permit management-interface traffic only from designated administrative source addresses.
Place the appliance management interface behind a VPN or jump host to eliminate direct exposure to untrusted networks.

bash

# Configuration example: restrict management-interface access using an upstream ACL
# Replace <mgmt_iface_ip> and <admin_subnet> with environment-specific values

# Permit trusted administrative subnet
access-list MGMT_ACL permit tcp <admin_subnet>/24 host <mgmt_iface_ip> eq 443

# Deny all other sources
access-list MGMT_ACL deny   tcp any host <mgmt_iface_ip> eq 443