CVE-2026-8699 is a stored XSS vulnerability in TP-Link Archer C5 v6.8 routers' web interface caused by insufficient server-side input validation and lack of proper output encoding. An attacker with admin rights can inject crafted HTML or JavaScript payloads into a specific field, which are stored and later executed in an administrator's browser. This enables arbitrary script execution, potentially resulting in session hijacking and unauthorized access to router settings. The issue affects ISP-managed firmware variants, with remediation coordinated through service providers. No official patch or remediation level has been published yet.

Successful exploitation allows execution of arbitrary JavaScript in an administrator's browser, which can lead to session hijacking and unauthorized access to router configuration. This may result in exposure of sensitive data and unauthorized modification of device settings. The vulnerability requires administrative privileges and user interaction (admin viewing the affected page).

Patch status is not yet confirmed — check the vendor advisory and service providers for current remediation guidance. Since remediation is coordinated through ISPs managing the firmware, administrators should monitor communications from their service providers for updates. Until a fix is available, restrict administrative access to trusted users and networks to reduce risk.