High-Severity Infrastructure Vulnerabilities Expose Critical Systems and Live Surveillance Feeds

Key Findings

• Ivanti ITSM vulnerability CVE-2026-9614 carries CVSS score of 8.8 and allows authenticated privilege escalation to administrator access

• KMW CCTV vulnerability CVE-2026-5386 has critical CVSS score of 9.1 and enables unauthenticated password reset on camera systems

• SaaS Ivanti deployments already patched automatically; on-premises versions 2025.4 and prior require immediate manual updates

• KM-IP521 and KM-IP421 camera models affected; vendor patches available but KM-IP421 update temporarily disables cloud features

• No confirmed customer exploitation reported for Ivanti flaw at time of disclosure

Background

Two significant vulnerabilities emerged this week targeting critical infrastructure systems. Ivanti's IT service management platform and KMW surveillance cameras both face serious exploitation risks. These flaws underscore how attackers continue targeting both enterprise software and physical security devices. Organizations worldwide must now assess their exposure and apply available fixes to prevent unauthorized access and data compromise.

Understanding CVE-2026-9614

Security researchers designated the Ivanti flaw as CVE-2026-9614, stemming from improper access control mechanisms within the platform core. The vulnerability carries a severe CVSS score of 8.8. An authenticated remote user can exploit this bug to seamlessly hijack administrative control of the entire ITSM system. The vendor confirmed that successful exploitation enables privilege escalation to administrator level, granting complete platform access. Fortunately, the company reported no known customer exploitation at the time of disclosure.

Remediation Paths for Cloud and On-Premises

Fix requirements depend entirely on your hosting infrastructure. Ivanti's software-as-a-service environments already received remediation through automatic service updates on May 24 and May 25. SaaS customers running Ivanti Neurons for ITSM require no action.

Organizations managing on-premises deployments must apply updates manually. Administrators running version 2025.4 or prior must upgrade to 2025.4 Patch 1 or later. These files are available on the official vendor download portal. Manual patching remains the only reliable way to block unauthorized administrative takeovers in local environments.

Understanding CVE-2026-5386

The KMW CCTV vulnerability carries an alarming CVSS severity score of 9.1. The bug stems from a critical architectural flaw allowing unauthenticated password reset on affected devices. An attacker can remotely change administrative credentials to a known value without any authentication requirements. This grants unauthorized users complete access to view camera feeds, adjust internal settings, and alter system logs to hide their activities.

Affected Camera Models and Firmware

The vulnerability specifically impacts two popular camera models: the KM-IP521 and KM-IP421 hardware units. Successful exploitation grants complete administrative entry to the device, compromising user privacy immediately. Exposed infrastructure leaves businesses completely unprotected against digital espionage and surveillance manipulation.

Implementing Vendor Mitigations

The manufacturer deployed fixed firmware to eliminate the risk. Administrators can patch devices by downloading the official update file immediately from vendor channels. However, users installing the KM-IP421 update will temporarily lose their cloud authorization feature during the transition.

The vendor recommends isolating all surveillance equipment on a separate network layer as an additional defensive measure. Proactive patching remains the best defense against camera exploitation. Following these mitigation steps will keep enterprise environments fully protected.

Sources

• https://securityonline.info/ivanti-itsm-vulnerability-privilege-escalation/

• https://securityonline.info/kmw-cctv-vulnerability-password-reset/