ASUS Router Security Updates, November 2026: AiCloud and Remote File Access Flaws, and How to Patch

Last updated: November 2026

This guide is for owners of ASUS and ROG wireless routers running ASUSWRT firmware, including the RT-AX, RT-BE, GT-AX, GT-BE, TUF Gaming and ZenWiFi lines, who want to know what ASUS's October and November 2026 security advisories cover, whether their router is affected, and how to update. It walks through the seven router advisories ASUS published between October 1 and November 10, 2026, the firmware update steps on current firmware, and the settings to turn off if a router cannot be updated. Advisory details were read from ASUS's security advisory feed on November 11, 2026.

Key Takeaways

• ASUS published seven router firmware advisories between October 1 and November 10, 2026, covering 16 CVEs. Three are rated Critical (CVSS 4.0 scores of 9.3 and 9.4), and the two newest, dated November 4 and November 10, concern the AiCloud and remote file access features.
• A third-party report lists the affected firmware branches as 3.0.0.4_386, 3.0.0.4_388 and 3.0.0.6_102, which together cover nearly every ASUS router sold since 2019. ASUS's own advisories do not name models or fixed firmware versions; they say to install the latest firmware.
• Most of the flaws require an attacker on your WiFi or LAN ("adjacent network"), so a strong WiFi password and guest-network isolation for untrusted devices reduce the risk while you update. Disable AiCloud, remote file access, WAN remote access and FTP on any router you cannot patch.

What did ASUS patch in November 2026?

ASUS's November 10, 2026 advisory fixes four flaws in the router's remote file access feature, the worst of them scored 8.7 (CVE-2026-88710), that let an attacker on the local network run commands with elevated privileges or crash the service. Its November 4 advisory fixes a buffer overflow in AiCloud (CVE-2026-84730, scored 8.7) that an unauthenticated attacker on an adjacent network can use to execute code, plus a network service flaw (CVE-2026-84729, scored 7.2) that can be used for denial of service.

AiCloud is ASUS's built-in feature for reaching USB drives attached to the router from the internet. Remote file access is the related sharing function that generates links to files on those drives. Both are off on a new router unless you turned them on, and both are the kind of internet-facing service that has produced ASUS advisories repeatedly since 2024.

SecurityOnline, which summarized the November 4 advisories, reported that ASUS said it was not aware of in-the-wild exploitation and that fixes were released for all affected models. One of the November 10 flaws (CVE-2026-88709, scored 7.0) requires physical access, because it is triggered by plugging in a crafted USB storage device.

Which ASUS router advisories are open right now?

Seven router advisories were published between October 1 and November 10, 2026. All seven carry the same instruction: install the latest firmware. The table lists each advisory, its CVEs, the highest score, and the feature involved.

The scores are CVSS version 4.0 as listed by ASUS. "Adjacent" in these advisories means the attacker is already on your WiFi or wired LAN, so a compromised laptop, a guest's phone, or a cheap smart plug on the main network is the realistic starting point. Two of the October 7 flaws and the October 1 flaw can be reached from the internet if an attacker can get an administrator to click a link or import a file.

Is my ASUS router affected?

Assume yes if your router runs ASUSWRT 3.0.0.4 (branches 386 or 388) or 3.0.0.6 (branch 102) and has not been updated since October 2026. ASUS's advisories say the flaws exist in "certain" router firmware without listing models, and SecurityOnline reported the three branches above, which span the RT-AC, RT-AX, RT-BE, GT and ZenWiFi families.

To check your version, sign in at http://www.asusrouter.com or the router's LAN address, and read the firmware version at the top of the page or under Administration, then Firmware Upgrade. Branch 386 firmware begins 3.0.0.4.386, branch 388 begins 3.0.0.4.388, and the current WiFi 7 branch begins 3.0.0.6.102. A release dated November 2026 or later on ASUS's download page for your model includes the fixes; ASUS has not published a per-model table, so the date is the practical test.

If your model is on ASUS's end-of-life list, no fix is coming. The October 7 and October 20 advisories both say owners of unsupported models should consider replacing the device.

How do I update ASUS router firmware?

On current firmware, go to Administration, then Firmware Upgrade in the web interface and click Check or Update. ASUS's support page, updated February 23, 2026, recommends the ASUS Router app as the easiest route and lists three methods on the web interface.

1. Connect to the router's WiFi or a LAN port and open http://www.asusrouter.com in a browser. Sign in with the router admin account, not your WiFi password.
2. Go to Administration, then Firmware Upgrade. If a new version is available, click Update. Do not power off the router during the update.
3. If the router does not find the update, download the newest firmware for your exact model from ASUS's support site, return to Administration, then Firmware Upgrade, click Upload, and choose the file.
4. Turn on Auto Firmware Upgrade on the same page and set a time window overnight. ASUS notes that updates it marks as required install automatically regardless.
5. Reboot after the update. ASUS's October 7 advisory says a reboot is needed to clear leftover IFTTT pairing tokens, and the November 4 advisory also calls for a reboot.

ASUS's support page recommends a factory reset after a firmware update (Administration, then Restore/Save/Upload Setting, then Factory default). That is sound advice after a major branch change but is not required for a security point release. If you skip it, at least save a backup of your settings before updating.

What should I turn off if I cannot update?

Disable AiCloud, remote file access and sharing links, WAN remote access, FTP, and any USB storage sharing you do not use. Those are the settings ASUS lists as interim mitigations across the November advisories, and they close the features each flaw lives in.

1. USB Application, then AiCloud 2.0: turn off Cloud Disk, Smart Access and Smart Sync. Delete any sharing links you created.
2. USB Application, then Servers Center: disable the FTP server. The October 20 advisory names FTP under AiDisk specifically.
3. Administration, then System: set Enable Web Access from WAN to No, and disable SSH or Telnet from WAN.
4. Wireless, then WPS: turn WPS off. ASUS's advisories do not mention WPS, but PCWorld reported on October 20, 2026 that a 16-year-old Broadcom WPS flaw known as WPSplinter affects ASUS, TP-Link, NETGEAR and Linksys models and has no complete fix; turning WPS off is the only control an owner has.
5. Guest Network: put smart plugs, cameras and visitors' devices on a guest network with access to intranet disabled. Most of the flaws require an attacker already on your LAN.
6. Do not import VPN client configuration files or restore settings backups from any source you did not create yourself. The October 1 and October 7 advisories describe both as attack paths.

ASUS also advises against pairing IFTTT while untrusted devices are on the network and against sharing diagnostic logs publicly, since logs can contain tokens.

Should I replace an end-of-life ASUS router?

Yes, if it is on ASUS's end-of-life list and you use any remote feature. ASUS's October advisories say owners of unsupported models should disable AiCloud, WAN remote access, port forwarding, DDNS, the VPN server, DMZ, port triggering and FTP, and consider replacement.

A router that only serves WiFi to a few devices, with every remote feature off and a current, patched router in front of it, is a low risk. A router that still runs an old AiCloud share or a VPN server for remote access is the target these advisories describe. NETGEAR's October 2026 advisory drew the same line between patched and unpatched models; see our NETGEAR security advisory guide for that list. If you are shopping for a replacement, note that the FCC's 2026 restrictions on foreign-made routers changed which new models can be sold in the US; our FCC router rules explainer covers which brands have approval.

FAQ

Is there an ASUS router vulnerability in November 2026?

Yes. ASUS published advisories on November 4 and November 10, 2026 covering CVE-2026-84729, CVE-2026-84730 and CVE-2026-88707 through CVE-2026-88710. The highest score is 8.7. The fix is a firmware update.

What is CVE-2026-84730?

CVE-2026-84730 is a buffer overflow in the AiCloud feature of ASUS router firmware. An unauthenticated attacker on an adjacent network can use it to execute code on the router. ASUS scored it 8.7 on CVSS 4.0 and released firmware fixes on November 4, 2026.

Which firmware version fixes the ASUS AiCloud flaw?

ASUS has not published a fixed version number per model. Install the newest firmware listed for your model on ASUS's support site; a build dated November 2026 or later includes the November 4 fixes.

Can I just turn off AiCloud instead of updating?

Turning off AiCloud removes the attack surface for CVE-2026-84730, and ASUS lists it as an interim step, but the October advisories cover other features. Update the firmware; use the settings changes only until you can.

Has the ASUS flaw been exploited?

SecurityOnline reported that ASUS said it was not aware of in-the-wild exploitation of the November 4 flaws as of publication. That can change once the fix is public and researchers compare firmware versions, which is why updating within days matters.

Do these flaws affect ASUS routers in access point mode?

Partly. AiCloud, FTP and WAN remote access are router-mode features, so a unit in access point mode behind another router exposes less. The authentication and network service flaws can still be reached from the LAN, so update it regardless.

Sources

• ASUS Product Security Advisory page and its advisory feed, read November 11, 2026
• SecurityOnline, November 5, 2026: ASUS security vulnerabilities patched in new updates
• ASUS support: How to update the firmware of your router to the latest version (WebGUI)
• ASUS end-of-life product list for networking
• PCWorld, October 20, 2026: Millions of routers have a 16-year-old flaw that nobody plans to fix