Is CVE-2026-9262 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9262 being exploited in the wild.

How severe is CVE-2026-9262?

Medium severity, with a CVSS score of 6.5, published 16 June 2026.

Which products and versions are affected?

Canon EOS Network Setting Tool 1.5.0 and earlier (included in EOS Utility Ver.3.12.0 through Ver.3.20.20).

Is there a fix for CVE-2026-9262?

A patch was published on 2026-06-15: Fix released in EOS Utility Ver.3.20.21 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9262 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-9262?

Check whether you run Canon EOS Network Setting Tool or Canon EOS Utility at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9262: Canon EOS Network Setting Tool insecure default FTP configuration

CVE-2026-9262 · Severity: medium · CVSS 6.5 · Published 2026-06-16

The Canon EOS Network Setting Tool, used to configure network connections for Canon cameras, uses an unencrypted protocol by default when testing FTP connections. This could allow an attacker on the same network to intercept sensitive login credentials as they are transmitted. If exploited, this could lead to unauthorized access to the file servers where camera images and videos are stored.

Technologies: Canon EOS Network Setting Tool, Canon EOS Utility. Vendors: Canon.

Quick answers

Is CVE-2026-9262 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9262 being exploited in the wild.
How severe is CVE-2026-9262?: Medium severity, with a CVSS score of 6.5, published 16 June 2026.
Which products and versions are affected?: Canon EOS Network Setting Tool 1.5.0 and earlier (included in EOS Utility Ver.3.12.0 through Ver.3.20.20).
Is there a fix for CVE-2026-9262?: A patch was published on 2026-06-15: Fix released in EOS Utility Ver.3.20.21 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9262 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9262?: Check whether you run Canon EOS Network Setting Tool or Canon EOS Utility at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as an insecure default initialization (CWE-1188) within the Canon EOS Network Setting Tool. The application defaults to using unencrypted FTP rather than secure alternatives like FTPS or SFTP during its communication test functions. A remote attacker who can monitor network traffic (e.g., via a man-in-the-middle position) could capture plaintext authentication credentials when a user performs a connection test. This affects both Windows and macOS versions of the tool. Canon has addressed this by releasing EOS Utility Ver.3.20.21, which includes an updated version of the Network Setting Tool.

Affected products

Canon EOS Network Setting Tool 1.5.0 and earlier (included in EOS Utility Ver.3.12.0 through Ver.3.20.20)

Timeline

2026-06-15: disclosed: Initial disclosure by Canon
2026-06-15: patched: Fix released in EOS Utility Ver.3.20.21
2026-06-16: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.