Cyber·Monitoring
Shai-Hulud Supply-Chain Attack Trojanizes 19 PyPI Packages
PyPI repository (global online service)· Global4 Jun
5 reportsPROPCYCAS
MediumAI Refreshed
ClosedMedium impactAI Generated
ZKTeco CCTV Camera Authentication Bypass Vulnerability (CVE-2026-8598)
Occurred 19 May 2026·Detected 23 May 2026·
Global deployment; vendor headquartered in China; affected infrastructure in commercial facilities worldwide1 reportEnded 29 May 2026
Cyber
CISA has issued an advisory for a critical authentication bypass vulnerability (CVSS 9.1) in ZKTeco CCTV cameras. An undocumented configuration export port accessible without authentication exposes camera credentials and service information. The affected firmware version SSC335-GC2063-Face-0b77 is deployed globally across commercial facilities. A patch (V5.0.1.2.20260421) has been released.
AI-generated from linked source reports. See our correction policy.
Impact verdict
Medium impact. MEDIUM: Second-pass historical recalibration. This cyber advisory or vulnerability item is relevant to Cyber and technology-dependent Property/Casualty books, but it does not evidence confirmed insured loss, claims activity, ransomware/business interruption, critical infrastructure outage, or quantified market impact sufficient for HIGH.
View assessment methodologyHow we grade what we know -- Known · Reported · Uncertain. Methodology →
Timeline
Status Change2 Jun 2026, 13:05
Lifecycle changed
monitoring → closed
Closure2 Jun 2026, 13:05
Event Closed
auto_closed_monitoring_timeout
Status Change29 May 2026, 05:30
Status changed to monitoring
Auto-transitioned: no updates for 6 hours
active → monitoring
Status Change28 May 2026, 22:34
Status changed to active
evidence_trigger: authoritative_fast_track
signal → active
De-escalation25 May 2026, 17:12
Impact changed
high → medium
Initial Detection23 May 2026, 21:18
Initial Detection
CISA has issued an advisory for a critical authentication bypass vulnerability (CVSS 9.1) in ZKTeco CCTV cameras. An undocumented configuration export port accessible without authentication exposes camera credentials and service information. The affected firmware version SSC335-GC2063-Face-0b77 is deployed globally across commercial facilities. A patch (V5.0.1.2.20260421) has been released.
An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication and exposes critical information about the camera such as open services and camera account credentials.
Source: CISA Advisories (Official Advisory) · View source
Lloyd's classifications
Tracking this kind of risk? Get an email when Cyber events escalate.
Get alerts