CVE-2021-36260Vulnerability
Hikvision Improper Input Validation
Reported by 5 independent sources · first reported by Recorded Future · last reported
Last reported 5 days ago
Fix due 24 Jan 2022
Used by ransomware: not knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 8 Oct 2026
What the reports say
5 reports, newest first · the exact sentence from each-
⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More“The majority of the activity attempts to exploit CVE-2021-36260, which allows unauthenticated command injection against unpatched Hikvision products.”
-
Spike in Attacks Targeting Digital Video Recorders in Ukraine“Attempts to exploit CVE-2021-36260 against Ukraine, recorded by GreyNoise: near zero for months, scanning from one of four IPs, a nine-day surge from all four, then a stop.”
-
Operation Master: Deconstructing a Multi-Tiered Intrusion and Monetization Pipeline“On one confirmed-compromise host the operator mapped internal subnets and scanned for vulnerable IP cameras (CVE-2021-36260).”
-
Multi-Functional Linux Botnet “Evooo1Bot”“CVE-2021-36260: Hikvision.Products.SDK.WebLanguage.Tag.Command.Injection”
-
June 2026 CVE Landscape“CVE-2021-36260”
Indicators reported together
named in the same reportsAlso named with it: CVE-2022-40684, CVE-2026-25089, CVE-2026-39808, CVE-2026-11645, CVE-2026-28318, CVE-2026-20230, CVE-2026-35616, CVE-2026-33825, CVE-2025-55182, CVE-2026-21509, CVE-2025-8088, CVE-2025-6218, CVE-2026-35273, CVE-2026-34073, CVE-2021-4034, CVE-2021-27137, CVE-2026-46817, CVE-2026-48907, CVE-2026-0257, CVE-2026-12569
Thanks — we review every report.