CVE-2026-57920: Peplink Intcontrol 2

High severity, CVSS 7.7. EPSS: 0.4% chance of exploitation in the next 30 days.

Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} endpoints.

Affected products

• Peplink Intcontrol 2: up to and including 2.14.2

Published 2026-06-26. Last modified 2026-07-02.