Is CVE-2022-26258 (D-Link DIR-820L Remote Code Execution) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2022-26258 to its Known Exploited Vulnerabilities catalogue on 8 September 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution. Any organisation running the affected product should treat remediation as urgent.

What “being exploited in the wild” means for this CVE

This question is not just about whether a vulnerability exists, it is about whether attackers are actively using it against real systems. For CVE-2022-26258, that changes the operational posture immediately: once a flaw is in CISA’s KEV catalogue, exposure should be treated as an active threat condition, not a routine patch queue item.

The practical question is whether your environment contains the affected D-Link DIR-820L product or any Internet-exposed instance of it. If it does, the issue is not theoretical. Remote code execution in a router or edge device can provide an attacker with a durable foothold, traffic interception opportunities, and a launch point for follow-on compromise.

For broader exploitation context, CISA’s Known Exploited Vulnerabilities Catalog is the authoritative source for whether a flaw has crossed into confirmed active exploitation. For vulnerability records and lineage, CVE Program and NIST National Vulnerability Database remain the primary references.

What to check first on exposed D-Link equipment

Start with asset confirmation, not patch work. Identify every DIR-820L instance, where it sits in the network, whether management interfaces are reachable from untrusted networks, and whether the device is performing routing, NAT, remote administration, or edge segmentation functions that would amplify impact if compromised.

If the device is still in service, verify the vendor advisory for the exact remediation path and compare that against your own firmware inventory. For consumer and branch-edge hardware, one common failure mode is assuming the device is “just a router” and therefore low priority, when in reality it may mediate trust boundaries, DNS flow, or remote access paths.

If you need a prioritisation frame, the fact that CISA placed the issue in KEV means active exploitation is already established, so the operational decision should be driven by exposure and business criticality rather than by trying to estimate whether your specific model is likely to be attacked next.

How to respond when patching is delayed

If you cannot remediate immediately, reduce exposure before anything else. Remove internet-facing administration, restrict management access to trusted networks, isolate the device from sensitive internal segments where feasible, and replace any default or weak administrative access paths. For edge devices, compensating controls matter because they often sit outside stronger enterprise monitoring and can be reached directly by opportunistic scanning.

Because the vulnerability can support remote code execution, also consider whether the device has been allowed to hold credentials, forwarding rules, or configuration secrets that would let an attacker pivot further once code execution is obtained. The control objective is to reduce the blast radius while you work toward retirement or replacement.

For organisations that rely on this class of equipment, the KEV catalogue should drive the same urgency you would apply to any confirmed exploitation case, and NVD can be used to cross-check identifiers and downstream references while you validate the vendor’s own instructions.

Risk and Threat Considerations

Actively exploited router flaws are high-value because they combine remote reachability, privileged network position, and often weak operational visibility. An attacker does not need to own the whole environment to gain value from one compromised edge device, especially when that device handles internal traffic or sits in front of smaller sites with limited monitoring.

Failure mechanism: Remote code execution on a network appliance can let an attacker run commands, alter settings, intercept traffic, or establish persistence before defenders notice, especially when the device is rarely logged or centrally monitored.

Impact: The most serious consequence is not only device compromise, but the downstream ability to redirect traffic, capture credentials, support lateral movement, or use the appliance as a foothold for further intrusion.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation makes rapid vulnerability handling and exposure tracking central.
Recommendation — Prioritise and remediate KEV-listed vulnerabilities using continuous asset and vulnerability tracking.
NIST CSF 2.0	ID.RA-01 — Asset vulnerabilities are identified and documented	The answer depends on confirming whether the exposed DIR-820L asset is present and vulnerable.
	PR.PS-02 — Software, firmware, and information are maintained, replaced, and removed consistent with policy	The fix path for an exploited firmware flaw is update or replacement of the vulnerable appliance.
Recommendation — Inventory the device and document its exposure before deciding remediation timing. Replace or update vulnerable firmware and remove unsupported hardware from service.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The subject is an actively exploited vulnerability requiring prompt remediation action.
	SC-7 — Boundary Protection	Compensating controls center on reducing exposure at the network boundary.
Recommendation — Apply flaw remediation promptly for the affected device or isolate it until fixed. Restrict management and network reachability to the vulnerable appliance.

Practitioner Guidance

What to prioritise: Treat external exposure of the affected router as the first decision point. If the device is internet reachable, remediate or isolate it before spending time on broader hygiene work elsewhere in the environment.

What to verify: Confirm whether the device is still supported, whether management access is disabled from untrusted networks, and whether any credentials, remote admin paths, or network trust assumptions depend on the appliance remaining in place.

Decision rule: If the device cannot be patched immediately, move to containment and replacement planning rather than accepting temporary exposure as normal. For KEV-listed flaws, delay should be an exception, not a default.

Practitioner takeaway: When a router CVE is in KEV, the key question is no longer “is it real?” but “how fast can we remove or contain the exposed asset before exploitation becomes an incident?”

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org