CVE-2021-36260: listed in the CISA KEV catalog CVE-2021-36260 · CVSS 9.8 CRITICAL · EPSS 99.9% · KEV 2022-01-10
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.
Is CVE-2021-36260 exploited? Listed in the CISA KEV catalog on 2022-01-10. Federal remediation due 2022-01-24. Past that date by 1719 days. EPSS puts exploitation in the next 30 days at 99.9%. Public exploit code: packaged in a public tool. Public detection rules exist. Which products and versions are affected? hikvision · ds-2cd2026g2-iu/sl firmware hikvision · ds-2cd2046g2-iu/sl firmware hikvision · ds-2cd2066g2-i(u) firmware hikvision · ds-2cd2066g2-iu/sl firmware hikvision · ds-2cd2086g2-i(u) firmware hikvision · ds-2cd2086g2-iu/sl firmware hikvision · ds-2cd2166g2-i(su) firmware hikvision · ds-2cd2186g2-i(su) firmware hikvision · ds-2cd2186g2-isu firmware hikvision · ds-2cd2326g2-isu/sl firmware hikvision · ds-2cd2346g2-isu/sl firmware hikvision · ds-2cd2366g2-i(u) firmware hikvision · ds-2cd2366g2-isu/sl firmware hikvision · ds-2cd2386g2-i(u) firmware hikvision · ds-2cd2386g2-isu/sl firmware hikvision · ds-2cd2426g2-i firmware hikvision · ds-2cd2446g2-i firmware hikvision · ds-2cd2526g2-i(s) firmware hikvision · ds-2cd2526g2-is firmware hikvision · ds-2cd2546g2-i(s) firmware Is there a patch? No patch identifier recorded here yet.
What PlainSec published about CVE-2021-36260 Primary sources What this record does not say KEV and EPSS are re-checked daily. Record last updated 2026-10-08.
CVE-2021-36260: listed in the CISA KEV catalog CVE-2021-36260 · CVSS 9.8 CRITICAL · EPSS 99.9% · KEV 2022-01-10
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.
Is CVE-2021-36260 exploited? Listed in the CISA KEV catalog on 2022-01-10. Federal remediation due 2022-01-24. Past that date by 1719 days. EPSS puts exploitation in the next 30 days at 99.9%. Public exploit code: packaged in a public tool. Public detection rules exist. Which products and versions are affected? hikvision · ds-2cd2026g2-iu/sl firmware hikvision · ds-2cd2046g2-iu/sl firmware hikvision · ds-2cd2066g2-i(u) firmware hikvision · ds-2cd2066g2-iu/sl firmware hikvision · ds-2cd2086g2-i(u) firmware hikvision · ds-2cd2086g2-iu/sl firmware hikvision · ds-2cd2166g2-i(su) firmware hikvision · ds-2cd2186g2-i(su) firmware hikvision · ds-2cd2186g2-isu firmware hikvision · ds-2cd2326g2-isu/sl firmware hikvision · ds-2cd2346g2-isu/sl firmware hikvision · ds-2cd2366g2-i(u) firmware hikvision · ds-2cd2366g2-isu/sl firmware hikvision · ds-2cd2386g2-i(u) firmware hikvision · ds-2cd2386g2-isu/sl firmware hikvision · ds-2cd2426g2-i firmware hikvision · ds-2cd2446g2-i firmware hikvision · ds-2cd2526g2-i(s) firmware hikvision · ds-2cd2526g2-is firmware hikvision · ds-2cd2546g2-i(s) firmware Is there a patch? No patch identifier recorded here yet.
What PlainSec published about CVE-2021-36260 Primary sources What this record does not say KEV and EPSS are re-checked daily. Record last updated 2026-10-08.