Is CVE-2020-26919 (Netgear JGS516PE Devices Missing Function Level Access Control) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2020-26919 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Netgear JGS516PE devices contain a missing function level access control vulnerability. Any organisation running the affected product should treat remediation as urgent.

What “Being Exploited in the Wild” Means for CVE-2020-26919

CISA listing this CVE in the Known Exploited Vulnerabilities catalogue is the practical signal that matters most for defenders: it is not just a theoretical flaw. For a network device, that means you should assume the weakness can be reached and used remotely unless you have evidence that the vulnerable product is absent, isolated, or already remediated.

The key security question is not whether the bug exists, but whether any JGS516PE device is still exposed in your environment. For infrastructure like this, exposure often persists because the device is overlooked, unmanaged, or sitting behind broad internal trust assumptions.

Why Missing Function Level Access Control Is High-Risk on a Network Switch

Missing function level access control is an authorization failure, not a simple configuration nuisance. It means a requester can reach administrative or privileged functions that should be blocked by server-side checks. On a network device, that can expose management functions, change network behaviour, or let an attacker move from low-privilege access to high-impact control paths.

That risk is especially serious because devices like switches are often trusted infrastructure. If an attacker gets function-level access on a management interface, the result can be broader than one device compromise: traffic redirection, segmentation failure, or a foothold for later access to more valuable systems.

For a broader view of how this class of weakness behaves across systems, Broken Access Control Prevention Guide is the most direct internal reference because it covers missing function level access control, authorization bypass, and server-side checks.

What to Check and What to Do Next

First confirm whether any Netgear JGS516PE devices exist in your inventory, including lab, remote office, and “forgotten” network segments. Then verify whether the management surface is reachable from networks it should not serve, because an exposed management plane is the condition that turns a published vulnerability into an operational risk.

If you find the device, follow the vendor advisory and CISA KEV catalogue for the exact remediation path. In practice, that means prioritising firmware or configuration remediation over routine maintenance queues, because KEV-listed issues are treated as active exploitation problems, not normal backlog items.

While you are verifying exposure, use Zero-Day and Exploited Vulnerabilities Guide for the triage sequence around KEV, emergency mitigation, and post-fix hunting, and use Vulnerability Management Guide for the prioritisation logic, exception handling, and verification that should follow.

Risk and Threat Considerations

This vulnerability is attractive to attackers because access control failures on infrastructure devices are often high leverage and low noise. If the management interface is reachable, exploitation can turn a small initial foothold into administrative control of network traffic or device settings.

Failure mechanism: The device fails to enforce function-level authorization, so a caller can invoke privileged operations without the intended access check.

Impact: An attacker may gain unauthorized control of the switch, alter network behaviour, or use the device as a stepping stone for broader internal compromise.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5, CIS Controls v8, OWASP ASVS and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	AC-6 — Least Privilege	Missing function level access control is an authorization failure on a device interface.
	AC-3 — Access Enforcement	The flaw is a failure to enforce function-level authorization checks.
Recommendation — Enforce least privilege so only authorized admin functions are reachable. Implement server-side access checks for every privileged device function.
CIS Controls v8	CIS-6 — Access Control Management	This CVE requires validating and restricting access to the management plane.
Recommendation — Restrict and review management access to exposed network devices.
OWASP ASVS	V8 — Authorization	The vulnerability is specifically a broken authorization control at function level.
Recommendation — Verify every privileged action is blocked unless the caller is authorized.
NIST CSF 2.0	PR.AA-05 — Identity and Access Management	The issue is an access-control failure on a network management surface.
Recommendation — Apply access-control checks to management functions and admin paths.

Practitioner Guidance

What to verify: Confirm whether any JGS516PE units are still deployed, whether management access is restricted to trusted admin paths, and whether the vulnerable interface is exposed to broad internal or external reachability. If you cannot prove those three points, treat the device as still at risk.

Decision rule: If the device is present and reachable, prioritise remediation immediately ahead of routine patch cycles. If remediation must wait, compensate by restricting management access, removing unnecessary exposure, and watching for signs that the interface has already been used in ways it should not allow.

Practitioner takeaway: For KEV-listed device flaws, the operational question is exposure, not curiosity, and the safest assumption is that any reachable instance deserves urgent remediation until proven otherwise.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org