Is CVE-2026-94367 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-94367 being exploited in the wild.

How severe is CVE-2026-94367?

High severity, with a CVSS score of 7.2, published 23 September 2026.

Which products and versions are affected?

OpenEye Apex Network Video Recorder 3.2.9.376 and earlier (vulnerable since at least 2.2.3.4); fixed in 3.4.3 and later.

Is there a fix for CVE-2026-94367?

A patch was published on 2026: Fixed in firmware 3.4.3 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-94367 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-94367?

Check whether you run OpenEye Apex Network Video Recorder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-94367: OpenEye Apex Network Video Recorder OS command injection in recbackup

CVE-2026-94367 · Severity: high · CVSS 7.2 · Published 2026-09-23

OpenEye Apex is a network video recorder that stores and manages surveillance footage from security cameras. An authenticated administrator can inject arbitrary operating system commands through backup configuration settings, gaining unauthorized code execution on the recorder with system-level privileges. This could allow an attacker with admin credentials to gain control of the entire surveillance system and access sensitive recordings.

Technologies: OpenEye Apex Network Video Recorder. Vendors: OpenEye.

Quick answers

Is CVE-2026-94367 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-94367 being exploited in the wild.
How severe is CVE-2026-94367?: High severity, with a CVSS score of 7.2, published 23 September 2026.
Which products and versions are affected?: OpenEye Apex Network Video Recorder 3.2.9.376 and earlier (vulnerable since at least 2.2.3.4); fixed in 3.4.3 and later.
Is there a fix for CVE-2026-94367?: A patch was published on 2026: Fixed in firmware 3.4.3 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-94367 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-94367?: Check whether you run OpenEye Apex Network Video Recorder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The recbackup component fails to properly sanitize backup-area configuration input before passing it to a shell command, enabling OS command injection. An authenticated administrator account is required to exploit this vulnerability. Successful exploitation allows arbitrary command execution with nvr user privileges on the device. A fix is available in firmware 3.4.3 and later (advisory notes 3.5.4 as current).

Affected products

OpenEye Apex Network Video Recorder 3.2.9.376 and earlier (vulnerable since at least 2.2.3.4); fixed in 3.4.3 and later

Timeline

2026-09-23: disclosed
2026: patched: Fixed in firmware 3.4.3 and later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.