Findings

CVE-2026-32326

SHARP routers do not perform authentication for some web APIs.

Published Mar 25, 2026 · updated Jun 17, 2026

SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password of the device is left as the initial one, the device may be taken over.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 25, 2026 · NIST NVD

    Detected

    SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password of the device is left as the initial one, the device may be taken over.

  2. Jun 17, 2026 · NIST NVD

    Updated

    SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password of the device is left as the initial one, the device may be taken over.

Sources

  • CVE.orgVulnerability recordCVE-2026-32326

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-32326

    SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password of the device is left as the initial one, the device may be taken over.

    nvd.nist.gov

References

CVE-2026-32326 · ZeroDay Findings