CVE-2026-19924 is a remote authentication bypass vulnerability in the R7WebsSecurityHandler function of the httpd component in Tenda AC10 firmware version 16.03.10.09_multi_TDE01. The flaw allows an unauthenticated attacker to bypass authentication controls, potentially leading to full compromise of confidentiality, integrity, and availability of the device. The vulnerability has a CVSS v3.1 base score of 9.8, indicating critical impact. Public exploit details have been disclosed, increasing the risk of exploitation. No vendor patch or official remediation guidance is currently provided.

Successful exploitation of this vulnerability allows remote attackers to bypass authentication mechanisms on the affected Tenda AC10 device. This can lead to complete compromise of the device, including unauthorized access to sensitive information, modification of device settings, and denial of service. The CVSS score of 9.8 reflects high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface to trusted networks only and monitor for suspicious activity related to authentication attempts.