---
id: "CVE-2026-105980"
kind: "vulnerability"
aliases: ["CVE-2026-105980"]
title: "WireGuard VPN function lets a privileged remote attacker run root commands"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "vpn", "wireguard"]
not_affected_if: []
published_at: "2026-11-03T09:17:10+00:00"
first_seen_at: "2026-11-03T09:19:50+00:00"
updated_at: "2026-11-03T09:21:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105980", "first_seen_at": "2026-11-03T09:19:50+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T09:21:00+00:00"}]
---

# WireGuard VPN function lets a privileged remote attacker run root commands

Improper input validation in the WireGuard VPN function may let a remote attacker with high privileges inject system commands. The injected commands run with root privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

unknown: the vendor and product are not yet named. Check your inventory for industrial routers or gateways with a WireGuard VPN feature from CERT@VDE partners, and watch certvde.com/en/advisories for the matching VDE-2026 advisory.

## Timeline

- 2026-11-03T09:19:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105980
- 2026-11-03T09:21:00+00:00 analyst — Published 7 min before review. CVE assigned by CERT@VDE (cvss_by info@cert.vde.com), so the vendor is probably a CERT@VDE partner, but NVD page returned no text and searches on the CVE id found no vendor advisory. Vendor, product, versions and fix are unknown. Other WireGuard command-injection CVEs in the results (TP-Link, InHand, GL-iNet, wg-easy) have different ids and I did not link them. To settle: recheck certvde.com/en/advisories for a new VDE-2026-xxx entry in a day. Nothing verified.

## From the sources

Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_