CVE-2026-9260

CriticalCVSS 9.8/10Last modified Jun 18, 2026

Description

Use of hard-coded cryptographic keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-321CWE-798

Affected software

No affected versions have been published.

Timeline

Published
Jun 16, 2026
Last modified
Jun 18, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-926006.5Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints oCVE-2026-926016.5Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and iCVE-2026-926027.1TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated CVE-2026-926036.5ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticateCVE-2026-926048.1Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role useCVE-2026-926056.5IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence CVE-2026-926087.5Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrCVE-2026-926099.8Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management sessioCVE-2026-92619.8Use of weak SSH cryptographic algorithms in Canon EOS Network Setting Tool Version 1.5.0 or earlierCVE-2026-926114.8In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at the first wildcard CVE-2026-926121.0In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::asCVE-2026-926156.6A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which
CVE-2026-9260: Critical severity, CVSS 9.8 | Vulnix