Ref.: #38251
Published: 2026-11-03 [Last updated: 2026-11-03]
Details:
A new vulnerability was reported a few days ago, and highlighted in this post.
According to one of the articles published, “Anthropic said on October 27 that its AI model wrote an exploit that uses the flaw to let a remote attacker with no credentials run commands as root on Linux servers with a multipath TCP (MPTCP) listener.”, the exploitation is targeted at the Linux kernel TCP flaw.
The flaw is a race condition in the code that sets up new IPv4 TCP connections. It can make the kernel read memory it has already freed, a bug type known as a use-after-free (UAF), being tracked as CVE-2026-98432. The possible risks to the network appliances could be kernel memory corruption or a system crash.
A few relevant references about the CVE:
NIST: NIST CVE-2026-98432
3rd Party: TCP Flaw CVSS 9.8
NOTES:
Firmware up to 8.6.1 contains the affected IPv4 TCP code. Potential impacts include kernel memory corruption or a system crash. MPTCP is disabled in the Linux kernel configurations, so Anthropic’s demonstrated MPTCP-based remote-root exploit is not established as applicable to these devices. Disabling MPTCP does not eliminate the underlying TCP vulnerability.
The vulnerability introduced the exploitation risk to InControl Virtual Appliance up to 2.14.4.2, Balance and MAX series routers running firmware up to the recent special build 8.6.1s054, and FusionHub firmware up to 8.6.1 GA.
Products affected by the risk:
-
ICVA firmware version 2.14.4.2 and earlier.
-
Peplink Balance and MAX series, FusionHub found in firmware versions up to 8.6.1.
InControl 2 is not vulnerable.
Solution
(A) ICVA firmware 2.14.4.3 is ready and can be downloaded from the ICVA firmware download page.
(B) Peplink Balance and MAX, FusionHub special firmware 8.6.1s062 (included fixes in 8.6.1s042 and 8.6.1s054) is ready for download. The fix will be included in the next GA release.
Here are the direct download links for special firmware 8.6.1s062:
| Download Link | Product | Hardware Revision |
|---|---|---|
| Download | B One | HW1 |
| B One 5G | HW1-2 | |
| B One Plus | HW1-2 | |
| Balance 310 | HW5 | |
| Balance 310 5G | HW3 | |
| Balance 580X | HW2 | |
| Dome Pro Duo | HW1-2 | |
| Dome Pro LR | HW1-2 | |
| MAX BR1 Pro | HW7-9 | |
| MAX BR1 Pro 5G | HW1-3 | |
| MAX BR2 Pro | HW4-5 | |
| MAX HD1 Dome Pro | HW1-2 | |
| MAX Orbit 2 | HW1 | |
| MAX Orbit 4 | HW1 | |
| MAX Orbit 8 | HW1 | |
| MAX Transit Duo Pro | HW1-3 | |
| MAX Transit Pro E | HW2-3 | |
| Download | Balance 1350 EC | HW1 |
| Balance 2500 EC | HW1 | |
| Balance 310 5G | HW1-2 | |
| Balance 310 Fiber 5G | HW1-2 | |
| Balance 310X | HW1-3 | |
| Balance 380X | HW1 | |
| Balance 5000 EC (100G) | HW1 | |
| Balance 5000 EC (40G) | HW1 | |
| Balance 580X | HW1 | |
| Balance Two | HW1 | |
| EPX | HW1 | |
| MAX HD2 MBX | HW1-4 | |
| MAX HD4 MBX | HW1-4 | |
| MAX MBX Mini | HW1-2 | |
| PDX | HW1-2 | |
| SDX | HW1-4 | |
| SDX Pro | HW1-2 | |
| Download | FusionHub | HW1-2 |
| Download | Balance 20X | HW1-3 |
| MAX BR1 IP55 | HW4 | |
| UBR Plus | HW1 | |
| Download | Balance 1350 | HW2 |
| Balance 2500 | HW1 | |
| Balance 305 | HW2 | |
| Balance 380 | HW6 | |
| Balance 580 | HW2-3 | |
| Balance 710 | HW3 | |
| MediaFast 500 | HW1-2 | |
| MediaFast 750 | HW1 | |
| Download | BR2 LTE | HW4 |
| BR2 Micro | HW1-3 | |
| MAX BR1 Mini | HW3-4 | |
| MAX BR1 Mini 5G | HW1,3 | |
| MAX BR1 Mini 5G | HW2 | |
| MAX BR1 Mini Core | HW3-4 | |
| MAX BR1 Mini M2M | HW1-2 |
We will update the post if anything changes.