CVE-2026-84941
Medium
Description
An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information.
SeverityMedium
CVSS6.9
Exploit probability—
ProductOmada Software Controller (Windows)
PublishedSep 11, 2026
First seenSep 11, 2026
Weakness typeCWE-611XML external entity (XXE)
How to fix
Update
- TP-Link Systems Inc. Omada Software Controller (Windows)6.2.14.11 or later
- TP-Link Systems Inc. Omada Software Controller (Linux)6.2.14.11 or later
- TP-Link Systems Inc. OC2000 v11.41.11 Build 20260711 or later
- TP-Link Systems Inc. OC2000 v22.26.11 Build 20260711 or later
- TP-Link Systems Inc. OC200 v33.3.11 Build 20260711 or later
- TP-Link Systems Inc. OC220 v11.6.11 Build 20260711 or later
- TP-Link Systems Inc. OC220 v22.5.11 Build 20260711 or later
- TP-Link Systems Inc. OC300 v11.35.11 Build 20260711 or later
- TP-Link Systems Inc. OC400 v11.13.11 Build 20260711 or later
Patches
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| TP-Link Systems Inc. Omada Software Controller (Windows) | v < 6.2.14.11 | 6.2.14.11 |
| TP-Link Systems Inc. Omada Software Controller (Linux) | v < 6.2.14.11 | 6.2.14.11 |
| TP-Link Systems Inc. OC2000 v1 | v < 1.41.11 Build 20260711 | 1.41.11 Build 20260711 |
| TP-Link Systems Inc. OC2000 v2 | v < 2.26.11 Build 20260711 | 2.26.11 Build 20260711 |
| TP-Link Systems Inc. OC200 v3 | v < 3.3.11 Build 20260711 | 3.3.11 Build 20260711 |
| TP-Link Systems Inc. OC220 v1 | v < 1.6.11 Build 20260711 | 1.6.11 Build 20260711 |
| TP-Link Systems Inc. OC220 v2 | v < 2.5.11 Build 20260711 | 2.5.11 Build 20260711 |
| TP-Link Systems Inc. OC300 v1 | v < 1.35.11 Build 20260711 | 1.35.11 Build 20260711 |
| TP-Link Systems Inc. OC400 v1 | v < 1.13.11 Build 20260711 | 1.13.11 Build 20260711 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.