CVE-2026-90822 is an OS command injection vulnerability (CWE-78) affecting FatPipe Networks MPVPN, WARP, and IPVPN appliances running firmware version 10.1.2r60p100. The vulnerability exists in the xtremed daemon's AuthFormServlet endpoint, which processes authentication data via a shell without proper neutralization of special elements. This allows an unauthenticated remote attacker with access to the management interface to execute arbitrary commands with root privileges. The management interface is disabled by default and must be enabled by the customer before it becomes accessible.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands as root on affected devices, leading to full system compromise. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with high impact on confidentiality, integrity, and availability. However, the attack surface is limited to environments where the management interface is enabled and reachable by the attacker.

No official patch or fix is currently available. The management interface is disabled by default, which mitigates exposure. Customers should ensure the management interface remains disabled unless absolutely necessary. If enabled, restrict access to trusted administrative networks only and implement WAN access control lists to limit access to trusted sources. Monitor vendor advisories for any forthcoming patches or updates.