CVE-2026-90823 is a stack-based buffer overflow vulnerability (CWE-121) in FatPipe Networks MPVPN, WARP, and IPVPN appliances running firmware version 10.1.2r60p100. The vulnerability exists in the /usr/sbin/auth_user_pass binary, where an unauthenticated remote attacker with access to the management interface can submit a crafted authentication request that triggers an unchecked copy into a fixed-size stack buffer. This can potentially allow arbitrary code execution with root privileges. The affected management interface is disabled by default and must be enabled by the customer before it becomes reachable. FatPipe advises restricting management access to trusted administrative networks and applying WAN access control lists to limit access to trusted sources.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code as root on the affected appliance, leading to full compromise of the device. This can result in complete loss of confidentiality, integrity, and availability of the device and potentially the network it manages.

No official patch or fix is currently available. The management interface affected by this vulnerability is disabled by default, which mitigates exposure. Customers should ensure this interface remains disabled unless absolutely necessary. If enabled, access must be strictly limited to trusted administrative networks and controlled using WAN access control lists to restrict access to trusted sources only. Monitor vendor advisories for any future patches or updates.