Is CVE-2026-85545 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85545 being exploited in the wild.

How severe is CVE-2026-85545?

High severity, with a CVSS score of 7.1, published 10 September 2026.

Which products and versions are affected?

Hikvision HikCentral Access Control some versions.

Is there a fix for CVE-2026-85545?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85545 attacked?

It is attacked over the network.

Am I affected by CVE-2026-85545?

Check whether you run Hikvision HikCentral Access Control at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85545: Hikvision HikCentral Access Control privilege escalation

CVE-2026-85545 · Severity: high · CVSS 7.1 · Published 2026-09-10

HikCentral Access Control is an access management system used to control physical entry points and security in facilities. Authenticated users with limited privileges can bypass role-based access controls to invoke API functions they should not have permission to use, potentially allowing them to modify security policies, grant themselves higher privileges, or access sensitive building security data.

Vendors: Hikvision.

Quick answers

Is CVE-2026-85545 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85545 being exploited in the wild.
How severe is CVE-2026-85545?: High severity, with a CVSS score of 7.1, published 10 September 2026.
Which products and versions are affected?: Hikvision HikCentral Access Control some versions.
Is there a fix for CVE-2026-85545?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85545 attacked?: It is attacked over the network.
Am I affected by CVE-2026-85545?: Check whether you run Hikvision HikCentral Access Control at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a privilege escalation issue in HikCentral Access Control caused by insufficient authorization checks on API endpoints. Authenticated users with low-privilege roles can invoke API interfaces that their role is not authorized to access, bypassing role-based access control (RBAC) mechanisms. The attack requires a valid authentication credential but no additional preconditions. An attacker with a standard user account could escalate privileges to perform administrative actions, compromise the integrity of access control policies, or retrieve sensitive security configuration data. Patches are expected to be available from Hikvision.

Affected products

Hikvision HikCentral Access Control some versions

Timeline

2026-09-10: disclosed

References

https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-hikcentral-access-control

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.