CISA flags critical EseeCloud camera flaws with no vendor fix
CISA published an ICS advisory for Guangzhou Juan IoT Technology's EseeCloud app (≤4.9.6) and firmware (≤4.9.86.0), citing hard-coded credentials and device rebinding flaws rated CVSS 9.8 critical. Successful exploitation could let attackers take control of affected IP cameras. The vendor did not respond to CISA's coordination attempts, and no patch is listed.
Sources and evidence
Attributed quotes
“Successful exploitation of these vulnerabilities could allow an attacker to gain control over affected IP cameras.”
“An attacker can use a hard-coded credential to log in to EseeCloud devices.”
“Guangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts.”
Summary last validated Oct 17, 2026
Reader actions
Report an issue
Use this for an incorrect summary, wrong source, duplicate story, or wrong category. Submissions are private and do not change the story automatically.
Related coverage
- security
Microsoft adds agent risk controls to Microsoft 365 E7 and Project Perception
Microsoft announced new security capabilities in Microsoft 365 E7 and Project Perception aimed at containing agent risk and adapting protection continuously. The company framed AI agents as a new class of insider threat, saying security operations must match the speed at which agents act. No pricing, availability dates, or technical specifics were disclosed in the post.
- security
Microsoft and NVIDIA publish whitepaper on open-weight model risk
Microsoft and NVIDIA released a whitepaper for enterprises deploying open-weight AI models. It offers a shared taxonomy for classifying risks, evaluation methods, and security controls to help organizations manage those risks in enterprise deployments.
- security
CISA and FBI warn election officials of phishing threats ahead of 2026 midterms
CISA and the FBI issued a Public Service Announcement warning election and campaign officials about cyber threats during the 2026 U.S. midterm elections. Actors may use phishing and smishing to steal login credentials or install malware, targeting officials with access to voter registration data, government contacts, and campaign information. The agencies urge vigilance and recommended cybersecurity practices.
- security
CISA Adds Fortinet and BeyondTrust Flaws to Known Exploited Vulnerabilities Catalog
CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog: CVE-2025-61624, a path traversal flaw in multiple Fortinet products, and CVE-2026-102764, an authentication bypass by spoofing in BeyondTrust Remote Support. CISA said such flaws are frequent attack vectors and pose significant risks to the federal enterprise.
- security
CISA Urges Patching of Actively Exploited BeyondTrust Remote Support Flaw
CISA warned that CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support 26.2.3 and earlier, is being actively exploited for initial access, persistence, privilege escalation, and lateral movement. CISA added it to its Known Exploited Vulnerabilities catalog on Oct. 16, 2026, and urged self-hosted appliance operators to apply patch BT26-05-RS immediately.