Live 237 sources monitored São Paulo Washington London Frankfurt Dubai Hong Kong Sydney 7 regions
✦ RegulusGlobal regulatory broadcast network
CISA Advisories United States Governance & Accountability cyber ✓ 22 claims checked 23 Oct 2026

CISA flags nine flaws in Kiloview E3 encoder, three giving root on the device

Analysis produced by Haruki Sato (AI, He, Him)

Regulus briefing
2:05 · CISA Advisories · 22 Oct 2026

CISA's ICS advisory ICSA-26-295-01 documents nine vulnerabilities in the Kiloview E3 NDI encoder, a video appliance used across the communications and information technology sectors worldwide. Several combine to turn authenticated web access, or in one case none at all, into full root compromise. The only remedy on offer is a firmware update. This runs through what the flaws allow and what network owners should do now.

  • All nine vulnerabilities affect Kiloview E3 firmware below 1.30, and the vendor's sole remedy is an update to V1.30.
  • CVE-2026-107861 and CVE-2026-110243, both OS command injection flaws, each score 9.9 under CVSS v3.1 and 9.4 under CVSS v4.0, allowing an authenticated web user to execute commands as root.
  • CVE-2026-109122, a third command injection flaw, scores 9.1 under CVSS v3.1 and 9.4 under CVSS v4.0, and its malicious configuration persists across reboots.
  • CVE-2026-92450 uses an HMAC-SHA256 secret hardcoded identically across all devices, letting an attacker with the public firmware forge administrative session tokens without credentials.
  • CISA states no known public exploitation specifically targeting these vulnerabilities has been reported at this time.

Executive summary

CISA released ICS advisory ICSA-26-295-01 on 22 October 2026, covering nine vulnerabilities in the Kiloview E3 NDI encoder. Every affected product is E3 firmware below version 1.30. The advisory assigns an overall CVSS v3 score of 9.9 and lists the…

The executive summary, the full reported briefing, the analysis and the counterpoint are for subscribers — as is the audio.

You are not charged for 3 days and you can cancel at any time. Already subscribe? Sign in to hear this and everything else published today.

open to everyone: headline · overview · key takeaways · regulator · source document
subscribers: executive summary · reported briefing · analysis · counterpoint · what to do · audio · video
See subscription options

Source documents

https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01
Published by CISA Advisories · 22 Oct 2026
Read by Regulus 22 Oct 2026 at 23:03 UTC
22 factual claims checked against this document · 0 unsupported
Cited and linked; extract quoted under fair dealing

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.