Is CVE-2026-8598 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8598 being exploited in the wild.

How severe is CVE-2026-8598?

Critical severity, with a CVSS score of 9.1, published 20 May 2026.

Which products and versions are affected?

Zkteco CCTV Cameras SSC335-GC2063-Face-0b77 Solution < V5.0.1.2.20260421; Zkteco SSC335-GC2063-Face-0b77 Solution < V5.0.1.2.20260421.

Is there a fix for CVE-2026-8598?

A patch was published on 2026-04-21: Firmware version V5.0.1.2.20260421 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8598 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-8598?

Check whether you run Zkteco CCTV Cameras SSC335-GC2063-Face-0b77 Solution or Zkteco SSC335-GC2063-Face-0b77 Solution at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8598: ZKTeco CCTV Cameras auth bypass via undocumented port

Q: Is there a fix for CVE-2026-8598?

A patch was published on 2026-04-21: Firmware version V5.0.1.2.20260421 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-8598 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-8598?

Check whether you run Zkteco CCTV Cameras SSC335-GC2063-Face-0b77 Solution or Zkteco SSC335-GC2063-Face-0b77 Solution at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8598 · Severity: critical · CVSS 9.1 · Published 2026-05-20

ZKTeco CCTV cameras, used for video surveillance and security monitoring, contain a security flaw that allows unauthorized access to sensitive device information. An undocumented communication port is left open, which can be accessed over the network without a password. An attacker could use this to steal camera account credentials and view configuration details, potentially compromising the entire security camera system and its video feeds.

Vendors: Zkteco.

Quick answers

Is CVE-2026-8598 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8598 being exploited in the wild.
How severe is CVE-2026-8598?: Critical severity, with a CVSS score of 9.1, published 20 May 2026.
Which products and versions are affected?: Zkteco CCTV Cameras SSC335-GC2063-Face-0b77 Solution < V5.0.1.2.20260421; Zkteco SSC335-GC2063-Face-0b77 Solution < V5.0.1.2.20260421.
Is there a fix for CVE-2026-8598?: A patch was published on 2026-04-21: Firmware version V5.0.1.2.20260421 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8598 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-8598?: Check whether you run Zkteco CCTV Cameras SSC335-GC2063-Face-0b77 Solution or Zkteco SSC335-GC2063-Face-0b77 Solution at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass vulnerability (CWE-288) exists in certain ZKTeco CCTV camera models due to an undocumented configuration export port. This port is accessible over the network and does not require any authentication to provide a full export of the device configuration. A remote, unauthenticated attacker can exploit this to retrieve critical information, including camera account credentials and details about open services. The vulnerability is confirmed in the SSC335-GC2063-Face-0b77 solution. ZKTeco has released firmware version V5.0.1.2.20260421 to remediate this issue.

Affected products

ZKTeco CCTV Cameras SSC335-GC2063-Face-0b77 Solution < V5.0.1.2.20260421

Timeline

2026-05-19: advisory: Initial ICS Advisory (ICSA-26-139-04) published by CISA
2026-05-20: disclosed: CVE-2026-8598 published to the NVD
2026-04-21: patched: Firmware version V5.0.1.2.20260421 released to address the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.