Critical Zero-Day in Legacy D-Link Routers Leaves SMBs Exposed

Legacy Hardware, Active Threat

D-Link has disclosed a maximum-severity zero-day vulnerability (CVE-2026-86296) affecting its DIR-822A dual-band Wi-Fi routers. The flaw comes with publicly available proof-of-concept exploit code, and because the device has reached end-of-life, no security patch will be released. This leaves any organization still using these routers exposed to potential remote attacks with no vendor-supported remediation path.

What This Means for SMBs

For small and mid-sized businesses, legacy network equipment often lingers in production environments long after vendor support ends—sometimes because "it still works" or budget constraints delay replacement. But unpatched routers at the network edge represent a critical entry point for attackers, especially when exploit code is publicly available. This incident underscores the importance of maintaining an accurate hardware inventory, tracking end-of-life dates, and budgeting for proactive equipment refresh cycles. If your organization is running DIR-822A routers or other unsupported network gear, immediate replacement should be a top priority. Attackers don't wait for convenient timing.

Read the full article on BleepingComputer

Need help auditing your network infrastructure or planning hardware refreshes? O-Cyrus helps SMBs identify and remediate security gaps in their IT environments before they become incidents. Contact our team or learn more about our security services.