---
id: "CVE-2020-26919"
kind: "vulnerability"
aliases: ["CVE-2020-26919"]
title: "NETGEAR JGS516PE Devices: Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.57468
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "NETGEAR JGS516PE Devices", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "jgs516pe", "netgear", "network-switch"]
not_affected_if: ["unknown"]
published_at: "2020-10-09T07:15:17+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:34+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-26919", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-26919", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26919", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# NETGEAR JGS516PE Devices: Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability

NETGEAR JGS516PE network switches are missing function-level access control, so some functions can be reached without the proper authorization check. An attacker who reaches the device may be able to perform actions they should not be allowed to perform.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NETGEAR JGS516PE Devices affected ? fixed ?

## Fix

Apply updates per vendor instructions (CISA KEV required action); the fixed firmware version is unknown from the sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-26919
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-26919
- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-26919

## From the sources

Netgear JGS516PE devices contain a missing function level access control vulnerability.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_