Live › vulnerability › CVE-2026-89409
Go to dashboardZ-Wave SDK 8.1.1 and earlier (700/800 series) and 6.85.02 and earlier (500 series) fail to validate the ZWAVE_CMD_NODES_EXIST handler. A device already on the network can send messages that cause other nodes to be removed from the network.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Products built on Z-Wave SDK 8.1.1 and earlier for 700/800 series devices, or 6.85.02 and earlier for 500 series devices. The attacker must first be a device that has already joined the network, so exposure depends on who can join the mesh. Sources do not say which vendor firmware is affected.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and earlier (for 500 series devices), missing checks in the ZWAVE_CMD_NODES_EXIST handler can result in nodes being removed from the network. These messages must come from a device that has already joined the network.
This page as .md · .json · in your agent: get_signal("CVE-2026-89409")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.