CISA ADP Vulnrichment

Answer in brief

CVE-2026-90822 records a Unknown severity vulnerability in CISA ADP Vulnrichment. The current sources do not mark it as known exploited. The current feed maps FatPipe Networks/IPVPN (generic), FatPipe Networks/MPVPN (generic), FatPipe Networks/WARP (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 17, 2026Updated Sep 17, 2026Source checked Sep 17, 2026First seen by HOL Sep 17, 2026Material review Sep 17, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 3 mapped packages or products
Fix availability: Not reported

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps FatPipe Networks/IPVPN (generic), FatPipe Networks/MPVPN (generic), FatPipe Networks/WARP (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
FatPipe Networks/IPVPNgeneric	10.1.2r60p100	Not reported
FatPipe Networks/MPVPNgeneric	10.1.2r60p100	Not reported
FatPipe Networks/WARPgeneric	10.1.2r60p100	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for FatPipe Networks/IPVPN, FatPipe Networks/MPVPN, FatPipe Networks/WARP.
Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

Published upstream
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 17, 2026

Sources and claim methodology

Upstream source description

FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerability in the xtremed daemon. An unauthenticated remote attacker with access to the affected management interface can submit crafted input to the AuthFormServlet endpoint, causing authentication data to be processed by a shell and allowing arbitrary commands to execute as root. The affected management interface is disabled by default and must be affirmatively enabled by the customer before the endpoint becomes reachable. FatPipe recommends restricting management access to trusted administrative networks and using WAN access control lists to limit access to trusted sources. Customers running the affected end-of-life firmware can contact FatPipe Support for help confirming their firmware version and upgrading to a current supported release at https://www.fatpipeinc.com/support/support, [email protected], or +1 800-724-8521 (option 3).

Quoted source text, attributed separately from HOL analysis.