Is CVE-2026-28767 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28767 being exploited in the wild.

How severe is CVE-2026-28767?

Medium severity, with a CVSS score of 5.3, published 3 April 2026.

Which products and versions are affected?

Gardyn Cloud API before 2.12.2026.

Is there a fix for CVE-2026-28767?

A patch was published on 2026-02-24: Initial vendor remediation and internal disclosure Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-28767 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-28767?

Check whether you run Gardyn Cloud API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28767: Gardyn Cloud API missing authentication in administrative notification endpoint

CVE-2026-28767 · Severity: medium · CVSS 5.3 · Published 2026-04-03

Gardyn Cloud API, which manages smart indoor gardening systems, contains a security flaw where a specific administrative notification endpoint is accessible without authentication. This could allow an unauthorized person to access system notifications or potentially sensitive operational data. While there is no evidence of active exploitation, such a flaw could impact customer privacy or provide insights into system operations.

Technologies: Gardyn Cloud API. Vendors: Gardyn.

Quick answers

Is CVE-2026-28767 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28767 being exploited in the wild.
How severe is CVE-2026-28767?: Medium severity, with a CVSS score of 5.3, published 3 April 2026.
Which products and versions are affected?: Gardyn Cloud API before 2.12.2026.
Is there a fix for CVE-2026-28767?: A patch was published on 2026-02-24: Initial vendor remediation and internal disclosure Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28767 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-28767?: Check whether you run Gardyn Cloud API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Gardyn Cloud API suffers from a missing authentication vulnerability (CWE-306) within a specific administrative endpoint used for notifications. An unauthenticated attacker can reach this endpoint over the network without providing valid credentials. Successful exploitation allows the attacker to access information handled by this administrative notification service. The vulnerability was addressed in Cloud API version 2.12.2026. This issue was part of a broader set of vulnerabilities affecting the Gardyn ecosystem, including the Home and Studio firmware and mobile applications.

Affected products

Gardyn Cloud API before 2.12.2026

Timeline

2026-02-24: patched: Initial vendor remediation and internal disclosure
2026-04-03: disclosed: Initial NVD publication and ICS-CERT advisory
2026-07-02: advisory: Last revision of the CISA ICS advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.