NETGEAR last updated its August 2026 security advisory on 18 August 2026. The document lists nine CVEs affecting Nighthawk routers, Orbi mesh units and several add-on satellites. Most follow-up coverage simply repeated the CVE numbers. Yet the useful information sits in the Fixed Version column of each table, because for seven models NETGEAR wrote EOS there instead of a firmware build. Those routers stay exposed and no patch is coming. Below you will find which models still receive fixes, which ones never will, and how much practical risk each flaw actually carries on a home network.
Nine flaws, and not one of them critical
NETGEAR rated five of the nine issues as MEDIUM and the other four as LOW. Nothing in this advisory carries a HIGH or CRITICAL rating. That detail matters, because the ratings track how hard each flaw is to reach in the first place.
Two MEDIUM entries, CVE-2026-11814 and CVE-2026-11739, are command injection flaws. Both need an attacker who can already intercept and modify traffic on your local network. NETGEAR calls this an attacker-in-the-middle position. Neither one is something a stranger can fire at your WAN port from the open internet. NETGEAR also notes that CVE-2026-11814 is limited to certain region-specific SKUs, so two identical-looking routers bought in different countries may not share the same exposure.
The remaining MEDIUM entries, CVE-2026-11737, CVE-2026-11738 and CVE-2026-9214, all come down to insufficient input validation. Each needs an authenticated administrator who is already on the local network. The four LOW entries, CVE-2026-11733 through CVE-2026-11736, are buffer overflows carrying the same requirement.
So the realistic threat model here is narrow. An attacker needs local network access, and in most cases the admin password as well. That is a very different picture from a remotely exploitable flaw, and it should shape how urgently you act.
The seven models that will never be patched
Seven models appear in at least one August 2026 table with EOS written where a firmware version belongs. They are the R7000, RAX20, RAX41, RAX42, RAX45, RAX50S and RAXE450.
For those rows NETGEAR states that the products have reached their End-of-Support phase and that no security updates are planned. The company recommends retiring the hardware and moving to a supported device. The R7000 is the starkest case. It appears in three separate tables and receives a fix in none of them, so every August 2026 issue that touches it stays open for as long as the router keeps running.
End-of-Support is decided per flaw, not per router
This is the detail that most summaries flatten, and it changes what owners should actually do.
A model tagged EoS does not automatically stop receiving every fix. The RAX20 shows the pattern clearly. It appears in five of the nine tables. NETGEAR shipped firmware for three of them, namely V1.0.17.142 for CVE-2026-11814 and CVE-2026-11739, then V1.0.18.144 for CVE-2026-11737. For the two buffer overflows, CVE-2026-11735 and CVE-2026-11736, that same router gets EOS and nothing more.
An RAX20 owner who installs the update therefore closes three issues and keeps two open permanently. Reading only the affected-model lists would suggest the router is either fully covered or fully abandoned. Neither reading is correct, and the difference only shows up if you read each table separately.
Which firmware version actually clears your router
The advisory lists a fixed version for every CVE, and those versions differ inside a single model. Take the RAX50. It appears with V1.0.16.132 against the two buffer overflows, V1.0.17.142 against CVE-2026-11814, and V1.1.6.36 against four other entries.
Those are not competing instructions. Firmware releases roll forward, so the newest build available for your model is the one that covers every row where a fix exists. Chasing an individual version number per CVE wastes time. Check the highest version listed for your model, then make sure the router is running that build or something later.
Supported hardware still needs the update installed
Being off the End-of-Support list is not the same as being safe. The NETGEAR Nighthawk RAX50 is a good example of a model that still receives firmware, and it appears in seven of the nine August 2026 tables. Its close sibling the RAX50S carries the EoS marker and gets nothing for CVE-2026-11736. Two routers with nearly the same name sit on opposite sides of the line, which is exactly why the model badge on the underside matters more than the product family name.
Orbi owners are on the list as well. The RBR760 router and the RBS760 add-on satellite both take V6.3.8.11 for CVE-2026-11814. Satellites run their own firmware, so updating the base unit alone leaves the rest of the mesh behind.
What to do this week
Start by reading the exact model string from the label, including any v2 or S suffix. Then open the router admin page or the Nighthawk app and note the running firmware version. Compare that against the fixed versions listed in the NETGEAR security advisory for your model.
Turn on automatic firmware updates if the router supports them. NETGEAR points out that devices with automatic updates enabled may already carry these patches, and that removes the need to track advisories by hand.
If your model sits on the End-of-Support list, plan a replacement rather than a workaround. Until then, reduce what an attacker on your network could reach. Use a strong and unique admin password, disable remote management, and keep untrusted devices and guests on a separate network so that local access is harder to obtain.
The severity ratings here justify a measured response rather than panic. Still, an unpatched router does not improve with age, and the EOS entries in this NETGEAR security advisory are a clear signal that the hardware has stopped being maintained.
