Is CVE-2026-9260 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9260 being exploited in the wild.

How severe is CVE-2026-9260?

Medium severity, with a CVSS score of 6.2, published 16 June 2026.

Which products and versions are affected?

Canon EOS Network Setting Tool 1.5.0 and earlier (EOS Utility Ver.3.12.0 to Ver.3.20.20); Canon EOS Utility 1.5.0 and earlier (EOS Utility Ver.3.12.0 to Ver.3.20.20).

Is there a fix for CVE-2026-9260?

A patch was published on 2026-06-15: Fix released in EOS Utility Ver.3.20.21 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9260 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-9260?

Check whether you run Canon EOS Network Setting Tool or Canon EOS Utility at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9260: Canon EOS Network Setting Tool hard-coded cryptographic keys

CVE-2026-9260 · Severity: medium · CVSS 6.2 · Published 2026-06-16

The Canon EOS Network Setting Tool, a utility used to configure network connections for Canon cameras, contains a security flaw where encryption keys are permanently embedded in the software. If an attacker gains access to a user's computer, they could use these keys to decrypt and steal sensitive login credentials used for transferring photos via FTP or SFTP. This could lead to unauthorized access to the servers where a photographer or organization stores their media.

Technologies: Canon EOS Network Setting Tool, Canon EOS Utility. Vendors: Canon.

Quick answers

Is CVE-2026-9260 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9260 being exploited in the wild.
How severe is CVE-2026-9260?: Medium severity, with a CVSS score of 6.2, published 16 June 2026.
Which products and versions are affected?: Canon EOS Network Setting Tool 1.5.0 and earlier (EOS Utility Ver.3.12.0 to Ver.3.20.20); Canon EOS Utility 1.5.0 and earlier (EOS Utility Ver.3.12.0 to Ver.3.20.20).
Is there a fix for CVE-2026-9260?: A patch was published on 2026-06-15: Fix released in EOS Utility Ver.3.20.21 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9260 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-9260?: Check whether you run Canon EOS Network Setting Tool or Canon EOS Utility at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Canon EOS Network Setting Tool (versions 1.5.0 and earlier) utilizes hard-coded cryptographic keys (CWE-321) within its binary. This vulnerability affects the software's FTP, FTPS, and SFTP communication test functions. A local attacker with access to the system can extract these static keys to decrypt stored authentication information. The flaw is present in both Windows and macOS versions of the tool, which is distributed as part of the EOS Utility suite (versions 3.12.0 through 3.20.20). Canon has released EOS Utility version 3.20.21 to address this issue.

Affected products

Canon EOS Network Setting Tool (included in EOS Utility) 1.5.0 and earlier (EOS Utility Ver.3.12.0 to Ver.3.20.20)

Timeline

2026-06-15: disclosed: Initial disclosure by Canon Inc.
2026-06-15: patched: Fix released in EOS Utility Ver.3.20.21
2026-06-16: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.