Peplink Firmware 8.6.0 RC5: New Features Arrive

Peplink has released Firmware 8.6.0 RC5, and this build is getting very close to a final production release. Release Candidate 5 carries a huge list of new features, improvements, and fixes that have been baking through several beta and RC cycles. If you have been waiting to see what the next major Peplink firmware branch brings, this is the version to watch.

Before we dig in, one important reminder: 8.6.0 RC5 is still beta firmware. That means it should be tested in a lab or non production environment first, not pushed straight onto a mission critical router. That said, an RC5 build is a strong signal that Peplink is nearing the finish line, and this release has enough new capability that many admins will want to start testing now.

You can download 8.6.0 RC5 from the Peplink Open Beta Program page here: https://www.peplink.com/support/downloads/open-beta-program/

Headline New Features

A few additions in 8.6.0 stand out because they change how you connect, secure, and manage your network.

WireGuard for Remote User Access. Peplink added WireGuard as a Remote User Access VPN option. WireGuard is known for its speed, its lean codebase, and its simple key based configuration, so this gives remote workers and field teams a modern, high performance option alongside the existing choices.

SpeedFusion Boost. This new capability improves application performance over SpeedFusion connections that use Starlink, 5G, and other suitable WAN links. For anyone running bonded or hot failover links across variable connections, this is a meaningful upgrade to real world throughput and responsiveness.

RADIUS over TLS (RadSec). Wi-Fi authentication gets a security boost with RadSec support, which wraps RADIUS traffic in TLS so credentials and authentication exchanges are encrypted end to end.

SFC Direct Access. The SF Connect App can now connect directly to supported routers, streamlining secure access for administrators and end users.

OneWeb integration. WAN support now includes OneWeb integration, expanding the low earth orbit satellite options that pair naturally with Peplink SpeedFusion for resilient connectivity.

Cellular, IPv6, and Starlink Improvements

The cellular and WAN side of 8.6.0 received a great deal of attention.

On the cellular front, 8.6.0 adds Multi-APN connection support, 5G SA Carrier Aggregation control on supported modules, framed routing for 5GK and 5GN modules, and support for up to four eSIM profiles on each cellular module. IPv6 support has been extended to selected cellular devices, and there is a new IPv6 SLAAC and DHCPv6 connection mode for Ethernet WAN.

Starlink users get more visibility, with Starlink status information now shown directly in WAN Details. Combined with SpeedFusion Boost, this makes Peplink an even stronger platform for satellite plus cellular deployments.

If you run Starlink alongside your Peplink gear, check your coverage area before you deploy: 

Management, Security, and SpeedFusion

There is a long list of quality of life and enterprise oriented improvements. A few worth calling out:

Security and authentication saw SHA2-384 support added for IPsec VPN Phase 2, permanent FIPS support enabled on eligible devices, NAS-Identifier support for Web Admin RADIUS authentication, and a new warning that IPsec and Remote User Access preshared keys should be at least 14 characters. Peplink also updated security standards so weak certificates and keys, such as DSA, short RSA keys, or legacy PKCS12 files, are no longer supported.

SpeedFusion picked up a MAC address whitelist for Layer 2 tunnels, an Advertise Routes to Peer setting for NAT Mode SpeedFusion, Route Isolation support on FusionHub, and support for up to 1000 SpeedFusion peers on B1350 EC devices.

For day to day management, 8.6.0 adds per-WAN bandwidth limiting through QoS, a dedicated Management Port configuration in LAN Port Settings on supported models, customizable SNMP trap alerts, GPS export through SNMP, WAN status summary logs, Jumbo Frame support on selected models, and Device API support for uploading and downloading configuration files using token based authentication. Wi-Fi AP defaults also shifted to WPA2 and WPA3 Personal on supported devices.

Resolved Issues and Security Fixes

RC5 specifically closes out several items found in earlier candidates, including a Management Port configuration availability issue, a cellular data connection problem on certain networks, a FIPS mode issue affecting InControl Remote Web Admin, and an IPv6 Passthrough change that previously required a reboot.

Just as important, the 8.6.0 branch rolled in security fixes, including a resolved CLI vulnerability that could allow command injection, a Web Admin vulnerability that could allow unauthenticated access to internal binaries, and an update to web service components to address CVE-2026-42945. These alone are a good reason to keep an eye on the 8.6.0 timeline.

Important Notices Before You Upgrade

A couple of items deserve attention before you load this build:

Some models must be upgraded to Firmware 8.5.4 first before moving to 8.6.0. This applies to the BR1 Pro (CAT-20), BR1 Pro 5G, and BR2 Pro, as well as all Dome, Transit, and B One devices. When FIPS is enabled, IPsec VPN preshared keys must be at least 14 characters long, so existing profiles with shorter keys may need updating before they reconnect.

Also note that starting with Firmware 8.6.0, a group of older legacy models are no longer supported on the new branch. Those units will continue to receive 8.5.x maintenance releases as needed, so check the release notes if you run older hardware.

5Gstore Take

Release Candidate 5 is a strong, feature rich build that signals 8.6.0 is close to production ready. WireGuard, SpeedFusion Boost, RadSec, broader IPv6 support, and the security fixes together make this one of the more consequential Peplink firmware branches in a while. Our advice is simple: grab it, test it in a controlled environment, and get familiar with the new features now so you are ready when the final release lands.

If you have questions about which Peplink models are affected, how to stage a safe upgrade, or how these features fit your deployment, our team is here to help. We work with the full lineup of connectivity brands we carry, including Peplink, Cradlepoint, Teltonika, Semtech, Inseego, Digi, and Katalyst, so we can help you plan the right solution end to end. Reach out to us anytime at https://5gstore.com/site/contact_us.

You can browse the full Peplink lineup on our site here: https://5gstore.com/landing/m/peplink/

Frequently Asked Questions

Is Peplink firmware 8.6.0 RC5 safe to run in production? It is still beta firmware, so it should be tested in a lab or non production environment first. RC5 indicates the release is getting close to final, but you should validate it against your own configuration before deploying widely.

Where do I download 8.6.0 RC5? It is available through the Peplink Open Beta Program page at https://www.peplink.com/support/downloads/open-beta-program/

Do I need to upgrade to another version first? Yes for some models. The BR1 Pro (CAT-20), BR1 Pro 5G, BR2 Pro, and all Dome, Transit, and B One devices must be on Firmware 8.5.4 before upgrading to 8.6.0.

What are the biggest new features in 8.6.0? Highlights include WireGuard for Remote User Access, SpeedFusion Boost, RADIUS over TLS (RadSec), SFC Direct Access, OneWeb WAN integration, broader IPv6 cellular support, and up to four eSIM profiles per module.

Does 8.6.0 include security fixes? Yes. The branch resolves a CLI command injection vulnerability, a Web Admin unauthenticated access vulnerability, and addresses CVE-2026-42945 in web service components, among other fixes.

Will my older Peplink router still be supported? Starting with 8.6.0, a set of older legacy models are no longer supported on the new branch and will receive 8.5.x maintenance releases instead. Check the official release notes for the full list.