Critical 9.8
KEV-listed
CVE-2021-36260
Hikvision Camera Exploitation Attempts in Ukraine Targeting CVE-2021-36260
Vendor / product: Hikvision
Event date: 2026-09-21
Public PoC: Yes
First tracked by RiskWire: 2026-10-09
CISA KEV catalog
Added to KEV
Federal remediation due
2022-01-24 (1719 days overdue)
Ransomware campaign use
Unknown
CISA description
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.
Required action
Apply updates per vendor instructions.
Sources & citations (4)
- Hackers Target Hikvision Cameras in Ukraine With Remote Code Execution Exploit Attempts cyberpress.org · 2026-10-09
- Hikvision Camera Vulnerability Targeted in Remote Code Execution Exploitation Attempts cybersecuritynews.com · 2026-10-08
- Spike in attacks targeting digital video recorders in Ukraine greynoise.io · 2026-10-08
- Ukraine-Focused Exploitation Attempts Target Critical Hikvision Command-Injection Flaw mallory.ai · 2026-10-08
References
See CVE-2021-36260 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →