D-Link warns of a maximum-severity zero-day vulnerability in DIR-822A routers

D-Link warned of two vulnerabilities affecting legacy DIR-822A routers. The first, CVE-2026-86296, has publicly available proof-of-concept (PoC) exploit code and no patch. It may allow unauthenticated attackers on the same local network to crash the DHCP daemon or potentially achieve remote code execution. D-Link is also investigating a second critical vulnerability, CVE-2026-86510, for which public PoC code is available. The source does not state that these vulnerabilities have been exploited in attacks.