TP-Link Systems Inc. Omada Software Controller (Linux) vulnerabilities

Latest TP-Link Systems Inc. Omada Software Controller (Linux) CVEs

Newest publication first

1. CVE-2026-84941 Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read

   Published 2026-09-10

   Medium·CVSS 6.9 EPSS 0.47%

   An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exp...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.