CVE-2026-107861 Kiloview CVE debrief

Who should care

Defenders responsible for Kiloview E3 NDI encoders, ICS environments, and firmware updates should assess exposure and apply updates. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review the vulnerability and take necessary actions to mitigate it.

Why it matters

CVE-2026-107861 is a critical OS command injection vulnerability in Kiloview E3 NDI encoder firmware. Authenticated web users can execute arbitrary OS commands as root, leading to full device compromise. Defenders should assess exposure, apply firmware updates, and monitor for suspicious activity.

• Execution of arbitrary OS commands as root
• Full device compromise by authenticated web users
• Potential lateral movement within ICS environments
• Need for urgent firmware updates and exposure assessment

Technical summary

The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise. The vulnerability has a CVSS score of 9.9 and is considered critical. The affected product is Kiloview E3 NDI encoder firmware versions before 1.30. The vulnerability can be mitigated by applying firmware updates to version 1.30 or later.

Defensive priority

Authenticated users with web access should verify and apply firmware updates, assess exposure, and monitor for suspicious activity.

Recommended defensive actions

• Verify and apply firmware updates to version 1.30 or later
• Assess exposure of Kiloview E3 NDI encoders in the environment
• Monitor for suspicious activity and unauthorized access attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item detail an OS command injection vulnerability in Kiloview E3 NDI encoder firmware versions before 1.30. An authenticated web user can execute arbitrary OS commands as root, leading to full device compromise.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.