CISA Advisory: VIVOTEK Camera Firmware

CISA has published a new security advisory. Here is a summary and what to do.

Threat Times Exposure DeskOctober 1, 20261 min read

Share LinkedIn Reddit

Illustration: A generic white security camera rests on a desk, its lens facing forward. — AI-generated illustration: Threat Times

Key points

New advisory from CISA.
Review affected versions in the advisory.
Apply updates promptly.

CISA published a security advisory titled “VIVOTEK Camera Firmware”.

At a glance

Publisher: CISA
CVEs: CVE-2026-22755

What the advisory says

View CSAF Summary Successful exploitation of this vulnerability may allow attackers to achieve remote command execution on affected devices, potentially with root privileges, leading to full compromise of the camera system. The following versions of VIVOTEK Camera Firmware are affected: V Series model_FD9187 (CVE-2026-22755) V Series model_FD9189 (CVE-2026-22755) V Series model_FD9365 (CVE-2026-22755) V Series model_FD9387 (CVE-2026-22755) V Series model_FD9389 (CVE-2026-22755) V Series model_FD9391 (CVE-2026-22755) C Series model_FE9180 (CVE-2026-22755) V Series model_FE9191 (CVE-2026-22755) V Series model_FE9382 (CVE-2026-22755) V Series model_FE9391 (CVE-2026-22755) V Series model_IB9365 (CVE-2026-22755) V Series model_IB9387 (CVE-2026-22755) V Series model_IB9389 (CVE-2026-22755) V Series model_IB939 (CVE-2026-22755) V Series model_IP9165 (CVE-2026-22755) V Series model_IP9171 (CVE-2

What should you do?

Read the full vendor advisory linked below and confirm whether you run affected versions.
Schedule the recommended update, prioritising internet-facing systems.
Watch for exploitation reports; unpatched edge devices are frequent targets.

What to do and how to stay safe: CVE-2026-22755

Patch scores alone ignore context like network exposure and asset criticality.
You must map vulnerabilities to specific business risks to prioritize correctly.
Continuous exposure data replaces static scanning for accurate prioritization.

Prioritize vulnerabilities by actual exploitability and business impact, not by theoretical severity scores. Update your asset context and exposure data continuously to maintain accurate risk rankings.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.