{"vulnerability": "CVE-2026-93958", "sightings": [{"uuid": "2eb04eb5-2a21-4ffc-9e42-5241027cc185", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93958", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117299592021830614", "content": "A new vulnerability with increased severity was disclosed for D-Link R95 (CVE-2026-93958) https://vuldb.com/vuln/407917", "creation_timestamp": "2026-09-19T20:29:00.998021Z"}, {"uuid": "f640e285-adeb-417e-b3de-a96a2b534e39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93958", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvw552odti2p", "content": "CVE-2026-93958 - r95\nThe D-Link R95 router can be tricked into running unauthorized system commands when an attacker changes the NTP server setting. This can be done from anywhere on the internet, giving the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#r95 #dlink #CVE #infosec", "creation_timestamp": "2026-09-20T02:20:14.751709Z"}, {"uuid": "c47ddf43-4573-41c8-a6a6-2efb56a55a2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93958", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvw7itlvud2r", "content": "\ud83d\udd34 CVE-2026-93958 - Critical (9.1)\n\nA vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function s...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-93958/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-20T03:02:38.729656Z"}, {"uuid": "88644024-27ba-4e4f-a285-5210829e2eeb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93958", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/fzz25pwvrygqk", "content": "CVE-2026-93958 - D-Link R95 DHMAPI ssi system os command injection\nCVE ID : CVE-2026-93958\n \n Published : Sept. 20, 2026, 2:16 a.m. | 1\u00a0hour, 12\u00a0minutes ago\n \n Description : A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system ...", "creation_timestamp": "2026-09-20T04:00:36.563480Z"}, {"uuid": "68a9b181-7496-400d-98f8-ebf72d58a84f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93958", "type": "seen", "source": "https://gist.github.com/ichintu/cdeedf6435a1cfc4f0c1b67ededf1aba", "content": "This daily threat intelligence update highlights two critical vulnerabilities disclosed in September 2026:\n\u2022 **CVE-2026-93958 (Critical, 9.1):** A remote OS command injection flaw in D-Link R95 routers, exploitable via the DHMAPI component's `NTPServer` argument.\n\u2022 **CVE-2026-93991 (High, 8.3):** An authorization bypass in Argo Workflows (v4.1.0\u20134.1.3) that allows attackers to bypass namespace restrictions and expose sensitive archived workflow data using negated field selectors.\n\nBoth vulnerabilities feature publicly disclosed, functional exploits, necessitating immediate patching or mitigation.", "creation_timestamp": "2026-09-20T04:01:15.895579Z"}, {"uuid": "9f670eaa-3314-4728-b6ec-fbb123d488fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-93958", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvwjgsdhy32x", "content": "D-Link R95 routers (BE9500_1.00.16) face a CRITICAL OS command injection (CVE-2026-93958, CVSS 9.4). No patch \u2014 public exploit exists. Restrict device exposure & monitor for abuse. https://radar.offseq.com/threat/cve-2026-93958-os-command-injection-in-d-link-r95-a15aa6eceda20938 #OffSeq #CVE20269...", "creation_timestamp": "2026-09-20T06:00:27.964863Z"}, {"uuid": "e341a53d-3dd2-4fdd-8a9a-894b823bc401", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-93958", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117301839393461308", "content": "CVE-2026-93958 (CRITICAL, CVSS 9.4): D-Link R95 BE9500_1.00.16 routers have an OS command injection flaw via the NTPServer argument in DHMAPI (/bin/ssi). Exploit is public, no patch yet \u2014 restrict access and monitor activity. https://radar.offseq.com/threat/cve-2026-93958-os-command-injection-in-d-link-r95-a15aa6eceda20938 #OffSeq #CVE202693958 #Vuln", "creation_timestamp": "2026-09-20T06:00:30.570894Z"}, {"uuid": "9b4678e7-469d-4706-adc4-9c3f0d1acb37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93958", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102865", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-93958\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HackSpeak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-20 13:16:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nD-Link R95 (BE9500) DHMAPI SetTimeSettings command injection -> root RCE PoC (CVE-2026-93958); for authorized testing\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-20T15:00:03.371628Z"}]}