CVE-2026-40621 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-40621 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-40621 is an authentication bypass vulnerability affecting ELECOM wireless LAN access point devices, where certain URLs can be accessed without any authentication credentials.

Technical Detail

The flaw exists because specific URLs on affected ELECOM wireless LAN access points are not protected by authentication controls, allowing unauthenticated access to those endpoints. An attacker with network access to the device can reach these unprotected URLs directly, potentially enabling unauthorized configuration changes, information disclosure, or full device takeover depending on the functionality exposed. The CVSS score of 9.8 reflects the low attack complexity and lack of required privileges or user interaction, consistent with a remotely exploitable authentication bypass on a network device.

Exploitation Status

No known exploit code has been identified at this time, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as no known exploit, meaning public proof-of-concept code or active in-the-wild exploitation has not been confirmed as of May 20, 2026. However, the straightforward nature of an authentication bypass on a network-accessible device lowers the barrier for independent discovery and exploitation.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability. Given that ELECOM devices are commonly deployed in small-to-medium business and consumer environments in Japan and the broader Asia-Pacific region, opportunistic scanning activity targeting exposed management interfaces remains a plausible concern.

What To Do

Apply any firmware updates released by ELECOM for affected wireless LAN access point models as the primary remediation step. Until a patch is applied, restrict network access to device management interfaces by placing them behind a firewall or management VLAN, and ensure the devices are not directly reachable from untrusted networks or the public internet. Review device logs for unexpected access to management URLs as a detection signal. Specific affected model numbers and patch versions have not been confirmed in available data at this time, so administrators should consult ELECOM's official security advisories to identify whether their deployed hardware is in scope.