Is CVE-2026-40066 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40066 being exploited in the wild.

How severe is CVE-2026-40066?

High severity, with a CVSS score of 8.8, published 17 April 2026.

Which products and versions are affected?

Anviz Cx2 Lite Firmware All versions; Anviz Cx7 Firmware All versions.

Is there a fix for CVE-2026-40066?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40066 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-40066?

Check whether you run Anviz Cx2 Lite, Anviz Cx2 Lite Firmware, Anviz Cx7 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40066: Anviz CX2 Lite and CX7 remote code execution via unverified updates

CVE-2026-40066 · Severity: high · CVSS 8.8 · Published 2026-04-17

Anviz CX2 Lite and CX7 facial recognition and time attendance devices are vulnerable to a security flaw in their update mechanism. An attacker can upload a malicious update package that the device will automatically unpack and execute. This allows an attacker to take full control of the device, potentially disrupting physical access control or stealing sensitive data.

Technologies: Anviz Cx2 Lite, Anviz Cx2 Lite Firmware, Anviz Cx7, Anviz Cx7 Firmware. Vendors: Anviz.

Quick answers

Is CVE-2026-40066 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40066 being exploited in the wild.
How severe is CVE-2026-40066?: High severity, with a CVSS score of 8.8, published 17 April 2026.
Which products and versions are affected?: Anviz Cx2 Lite Firmware All versions; Anviz Cx7 Firmware All versions.
Is there a fix for CVE-2026-40066?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40066 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-40066?: Check whether you run Anviz Cx2 Lite, Anviz Cx2 Lite Firmware, Anviz Cx7 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Anviz CX2 Lite and CX7 firmware versions are vulnerable to CWE-494 (Download of Code Without Integrity Check). The devices allow the upload of update packages that are not properly verified for authenticity or integrity. Upon upload, the device automatically unpacks the package and executes contained scripts. This flaw enables an attacker with network access to achieve remote code execution (RCE) with high privileges. While the CVSS vector indicates low privileges are required, the summary describes the result as unauthenticated RCE. As of the advisory date, the vendor has not provided a patch, and users are advised to contact Anviz for support.

Affected products

Anviz CX2 Lite Firmware All versions
Anviz CX7 Firmware All versions

Timeline

2026-04-16: advisory: CISA published ICSA-26-106-03
2026-04-17: disclosed: CVE-2026-40066 published in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.