CVE-2026-66887

CriticalCVSS 9.6/10Last modified Sep 18, 2026

Description

The affected products are missing authorization on state-changing CGIs and session checks are not performed.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Digital WatchdogVMAX A1 G4 DVRAll
Digital WatchdogVMAX IP G4 NVRAll
Digital WatchdogVMAX A1 PLUSAll
Digital WatchdogVA1G4 RecorderAll
Digital WatchdogVG4 RecorderAll

References

Timeline

Published
Sep 15, 2026
Last modified
Sep 18, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-66894.3Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Fail to enforce PermissionInviteUser when sCVE-2026-668909.6The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable.CVE-2026-668979.9A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launchiCVE-2026-668989.9A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When iCVE-2026-66907.2The LifePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'n' parameter of the lp_update_mds AJAX action in alCVE-2026-669017.5Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from theCVE-2026-669029.8Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call. The PlugCVE-2026-669036.5Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz. This CVE-2026-669069.1Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.CVE-2026-669077.5Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9CVE-2026-669087.5Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.CVE-2026-669099.8Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictio
CVE-2026-66887: Critical severity, CVSS 9.6 | Vulnix