CVE-2026-81531

An information disclosure vulnerability has been identified in Omada Controller.  An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users.  Successful exploitation may allow an attacker to remote query the affected endpoint that may facilitate user enumeration and subsequent attacks targeting administrative accounts.

• https://support.omadanetworks.com/en/download/software/omada-controller/
• https://support.omadanetworks.com/us/document/133567/
• https://support.omadanetworks.com/us/download/software/omada-controller/