23 October 2026 – Peplink has released security fixes for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560) affecting InControl Virtual Appliance (ICVA) and Balance and MAX routers with the Edge Computing feature enabled. Edge Computing is disabled by default. Peplink-hosted InControl 2 and other models are not affected.

Who needs to update:

• ICVA 2.14.3 and earlier: update to 2.14.4 or later.
• Balance and MAX routers with Edge Computing enabled, on firmware 8.4.0 to 8.6.1s042: update to 8.6.1s054, which covers all three issues. The changes will be included in the next GA release.

We recommend that all affected customers update as soon as possible and follow the steps in the security advisories below.

Can’t update yet? The advisories list simple steps to block outside access in the meantime.

The Peplink team will continue to monitor for possible vulnerabilities and keep customers informed through the Peplink forum and website.

Update history

• 27 October 2026: Confirmed earlier firmware versions 8.4.0 to 8.6.0 are also affected.
• 28 October 2026: Confirmed other models are not affected.
• 29 October 2026: Added CVE-2026-115560, a related PHP vulnerability. Balance and MAX routers with Edge Computing enabled should update to 8.6.1s054.