CVE-2026-7839 describes a vulnerability in UltraVNC repeater through version 1.8.2.2 where the HTTP administration server initializes with a hardcoded default password "adminadmi2" if the settings file is absent on first run. The authentication mechanism does not implement rate-limiting or lockout, enabling remote attackers with network access to the HTTP port (default TCP 80) to authenticate as administrator using this known credential. Successful exploitation allows full administrative control over the repeater's configuration and session management.

An attacker who can reach the repeater's HTTP administration port can gain unauthorized administrative access by using the hardcoded default password. This access allows modification of configuration settings, including allow/deny rules, and visibility into active sessions. The vulnerability does not impact availability but compromises confidentiality and integrity of the repeater configuration and session data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should ensure the settings file is created with a secure password before exposing the HTTP administration interface to untrusted networks. Restrict network access to the repeater's HTTP port to trusted hosts only to reduce exposure.