Peplink Firmware 8.6.0 RC3: SpeedFusion Boost Arrives

Peplink released Router Firmware 8.6.0 Release Candidate 3 on June 18, 2026, and it is now available for testing on the Peplink beta firmware page. RC3 is a feature packed build that carries forward everything introduced across the 8.6.0 Beta and earlier RC cycles, then layers on fresh improvements and two important security fixes. The headline item for anyone running Starlink, 5G, or any other unpredictable link is SpeedFusion Boost, a tunnel optimization that finally graduates into the mainline 8.6.0 branch.

Below is a detailed walkthrough of what is new, what changed, what got fixed, and what you need to know before you upgrade.

What Is SpeedFusion Boost?

SpeedFusion Boost is a built in optimization that runs inside the SpeedFusion tunnel. Its job is to sustain high throughput across lossy and unpredictable links so that data flows stay fast, smooth, and consistent even when the underlying connection is having a bad day. In the 8.6.0 release notes, Peplink describes it as a feature that improves application performance over SpeedFusion connections using Starlink, 5G, and other suitable WAN links.

To understand why Boost matters, it helps to remember how the rest of SpeedFusion behaves. SpeedFusion is Peplink’s patented technology that wraps your traffic in an encrypted tunnel between two endpoints, usually a Peplink router and a SpeedFusion hub or FusionHub, then makes packet by packet decisions about how to move that traffic. The three classic behaviors are:

• Bandwidth Bonding splits a single session across multiple WANs to add up usable throughput.
• WAN Smoothing sends duplicate packets across links and keeps the first copy that arrives, trading bandwidth for lower jitter and fewer dropped frames.
• Hot Failover instantly shifts a live session to a healthy link the moment one degrades, with no reconnect.

Those tools are excellent when you have multiple healthy links to play with. The hard case is the one most field deployments actually face: a single primary link, or a small number of links, that suffers from changing latency, jitter, and packet loss. Starlink is the textbook example. Its latency and jitter swing far more than a clean wired or terrestrial 5G link, which makes naive bonding counterproductive because the receiver burns time reordering packets and waiting on stragglers.

This is the gap SpeedFusion Boost is designed to fill. Rather than relying on a second clean link to mask problems, Boost optimizes the behavior of the tunnel itself so a single rough link, or a set of rough links, delivers steadier real world performance. The result is higher and more consistent throughput on exactly the kind of LEO satellite and cellular connections that dominate mobile, maritime, and remote site networking today.

Why Boost Belongs in Your Toolkit

A few practical takeaways:

• Starlink primary sites benefit the most. If Starlink is your main pipe and a 5G SIM is your backup, Boost helps keep performance steady through the satellite handoffs and fade events that would otherwise show up as stalls.
• It pairs with, not replaces, Smoothing and Bonding. Boost is another lever inside the same tunnel. You still choose Bonding for raw throughput on similar links, Smoothing for jitter sensitive voice and video, and Hot Failover for clean session persistence.
• InControl and PrimeCare still apply. As with other SpeedFusion features such as Bonding, Smoothing, and Hot Failover, InControl must be enabled on PrimeCare devices for the software features to activate. Keep that in mind on any PrimeCare hardware before you expect Boost to engage.

If you want to see how SpeedFusion fits into a real Starlink plus cellular design, our team can walk you through hub options, licensing limits, and the right hardware for your throughput target.

New Features in 8.6.0

Beyond Boost, 8.6.0 introduces several capabilities that touch remote access, satellite WAN, and Wi-Fi security:

• SpeedFusion Boost (Beta 1) improves application performance over SpeedFusion connections using Starlink, 5G, and other suitable WAN links. Available on all models.
• WireGuard for Remote User Access (Beta 2) adds WireGuard as a Remote User Access VPN option, giving administrators a modern, fast, and lightweight client VPN choice alongside existing methods. All models.
• OneWeb WAN integration (Beta 2) adds OneWeb support, expanding Peplink’s multi orbit satellite story beyond Starlink. All models.
• SFC Direct Connect (Beta 3) lets the SpeedFusion Connect App connect directly to supported routers, simplifying client to router access. All models.
• RADIUS over TLS, also known as RadSec (Beta 1) adds encrypted RADIUS transport for Wi-Fi authentication on a broad set of Balance, Dome, MBX, UBR, BR, Transit, Orbit, B One, and PDX models.

Improvements Worth Knowing

The Improvements list in 8.6.0 is long, spanning fourteen pages in the official notes. Here are the changes most likely to matter to a 5Gstore customer, grouped by area.

SpeedFusion, Routing, and VPN

• Serial Interface in Local Service Firewall rules (RC3) lets you control access to serial ports by firewall policy on BR1 Mini M2M, BR2 Pro, all Transit models, and MAX Orbit 4.
• MAC address whitelist for Layer 2 SpeedFusion tunnels (RC2), including MAC prefix matching, on all models.
• Virtual Network Mapping for inter VLAN traffic (RC2), including mappings to virtual IPs that overlap with VLAN subnets.
• Advertise Routes to Peer setting for NAT Mode SpeedFusion VPN (RC1), so route advertisement to remote peers can be disabled.
• SpeedFusion VPN Route Isolation on FusionHub (RC1).
• Up to 1000 SpeedFusion peers on Balance 1350 EC devices.
• SHA2-384 authentication for IPsec VPN Phase 2, plus a new warning that IPsec and Remote User Access preshared keys should be at least 14 characters.
• BGP enhancements, including importing BGP default routes, redistributing BGP default routes to OSPF, and importing routes only from a specified ASN.

Cellular, eSIM, and Satellite

• 5G SA Carrier Aggregation control on supported 5GK and 5GN modules.
• 5G SA support for 5GD modules and firmware upgrades for 5GN modules that add RED DA support and improved 5G SA network compatibility.
• Up to four eSIM profiles per cellular module, support for the newer GSMA eSIM profile format, and clearer Peplink eSIM carrier name display.
• One click option to erase all SMS messages stored on a SIM.
• Configurable 5G signal strength thresholds and improved cellular WAN startup times.
• Starlink status information added to WAN Details, so dish health surfaces directly in the router.

System, Wi-Fi, and Edge

• Per WAN bandwidth limiting so configured upload and download caps are enforced on real traffic.
• Static routes that resolve through a domain name.
• WAN failover event logs for entering and exiting backup state, plus WAN status summary logs to troubleshoot connectivity.
• GPS information export over SNMP.
• Jumbo Frame support on selected Dome, Transit, and B One models, and LACP on Balance 580X HW2.
• Edge Compute on B One Series when PrimeCare is active, and automated Docker container and image removal.
• Synergy WAN transport mode to choose between Performance and Compatibility, plus support for up to 40 Synergy WAN connections.
• PPSK names in the wireless client list, the ability to enable or disable specific Wi-Fi data rates per radio, and tri band AP support in the AP Controller.

Security Hardening

• Stronger certificate and key standards. Weak certificates and keys such as DSA, short RSA keys, and legacy PKCS#12 files are no longer supported. If an outdated certificate is detected, the device automatically falls back to a secure default certificate. Review the Certificate Manager and replace anything outdated before upgrading.
• Permanent FIPS support enabled on eligible devices, with several model families excluded.

Resolved Issues, Including Two Security Advisories

RC3 closes out a large batch of fixes. Two stand out as security advisories and are reason enough to plan a test upgrade:

• CLI command injection vulnerability fixed (RC3) on all models.
• Web Admin vulnerability fixed (RC3) that could allow unauthenticated access to internal binaries, on all models. Earlier in the cycle, web service components were also updated to address CVE-2026-42945, and SSH CLI components were updated for multiple vulnerabilities.

Other notable fixes include a SpeedFusion VPN issue where profiles could remain stuck in “Updating Routes…” after a firmware upgrade, a RemoteSIM client that might stop working unexpectedly, numerous cellular reconnection and SIM failover corrections, Starlink detection and status fixes, Docker CPU and image pull fixes, and a long list of Wi-Fi AP and system stability repairs.

Important Upgrade Notices

Before you flash anything, read these:

• Two step upgrade required for some models. BR1 Pro, BR2 Pro, Transit Duo Pro, Transit Pro E, HD1 Dome Pro, Dome Pro Duo, Dome Pro LR, and all B One Series models must be upgraded to Firmware 8.5.4 first, then to 8.6.0.
• FIPS preshared keys. With FIPS enabled, IPsec VPN preshared keys must be at least 14 characters. Existing profiles with shorter keys may need updating before they reconnect.
• SpeedFusion compatibility. SpeedFusion VPN on 8.5.2 or above is not compatible with devices running 8.0.0 or below.
• AP Controller regions. If your Wi-Fi Operating Country is set to Taiwan or Brazil, review your Wi-Fi channel configuration and reapply settings.
• PrimeCare and InControl. InControl must be enabled on PrimeCare devices to activate software features such as SpeedFusion Bonding, Smoothing, and Hot Failover.

Known Issues

A handful of items remain open in RC3:

• Docker containers cannot run on a device without an active DHCP server.
• When WAN Web Admin Access is enabled, SFC Direct Connect may be unable to reach the router Web Admin or LAN devices.
• LAN clients on ports 1 or 2 may fail to obtain an IP with Multiple IP passthrough WAN support.
• YouTube blocking may not work when YouTube traffic uses QUIC.

Models Reaching End of Support

Starting with Firmware 8.6.0, several legacy products are no longer supported and will continue to receive 8.5.x maintenance releases only. This includes the Balance 30 LTE, 30 Pro HW1, 210 HW4-5, 310 HW4, One HW1-3, and One Core HW1, a wide range of older MAX models such as the 700, BR1 ENT, HD1 Dome, HD2, HD4, and earlier Transit hardware, the MediaFast 200 HW1 and HW3, and the SFE CAM HW1. If you operate any of these, plan a hardware refresh path. We can help you map an older unit to a current equivalent.

Where to Download

This is release candidate software intended for testing. Grab 8.6.0 RC3 from the official Peplink beta firmware downloads page: https://www.peplink.com/support/downloads/beta-firmware/#routers. Always test beta firmware on a non production device or during a maintenance window, and confirm you have a current configuration backup first.

For product details and current models, see our Peplink manufacturer landing page.

5Gstore Take

SpeedFusion Boost is the change we are most excited to see reach the 8.6.0 branch, because it targets the single most common real world pain point we hear about: a Starlink or 5G link that is fast on paper but jittery in practice. Boost works inside the tunnel to keep throughput steady, which is exactly what mobile fleets, maritime operators, and remote sites need. Pair it with a well sized hub, a sensible backup link, and the right hardware, and you get the kind of connection that simply behaves.

At 5Gstore we sell and support Peplink alongside Cradlepoint, Teltonika, Semtech, Inseego, Digi, and Katalyst, so we can help you compare platforms honestly and pick the firmware, licensing, and hardware mix that fits your deployment. If you want help testing 8.6.0 RC3, planning a two step upgrade, or designing a SpeedFusion Boost setup around Starlink and 5G, reach out to our team and we will get you pointed in the right direction.

Frequently Asked Questions

What is SpeedFusion Boost in plain terms? It is an optimization built into the SpeedFusion tunnel that keeps throughput high and steady on lossy, unpredictable links like Starlink and 5G, even when those links are jittery or dropping packets.

Is 8.6.0 RC3 safe to run in production? It is release candidate software meant for testing. Use it on a lab or non critical device, or during a planned maintenance window, and back up your configuration before upgrading.

Do I need to upgrade in two steps? Some models do. BR1 Pro, BR2 Pro, Transit Duo Pro, Transit Pro E, HD1 Dome Pro, Dome Pro Duo, Dome Pro LR, and all B One Series units must move to 8.5.4 before going to 8.6.0.

Does SpeedFusion Boost replace WAN Smoothing or Bonding? No. Boost is an additional optimization inside the same tunnel. You still use Bonding for throughput, Smoothing for jitter sensitive traffic, and Hot Failover for seamless link switching.

Why are there security fixes in this release? RC3 fixes a CLI command injection vulnerability and a Web Admin vulnerability that could allow unauthenticated access to internal binaries. Earlier builds in the cycle also addressed CVE-2026-42945 and SSH CLI vulnerabilities, which is a strong reason to plan testing soon.

Is my older Peplink router still supported? Several legacy Balance, MAX, MediaFast, and SpeedFusion Engine models reach end of support at 8.6.0 and will only receive 8.5.x maintenance releases. Contact us and we can confirm your model and suggest a replacement if needed.