CISA has warned that Kiloview E3 NDI encoders contain nine vulnerabilities, including three high‑risk OS command injection flaws that could allow a logged‑in attacker to gain root access. The flaws are tracked as CVEs including CVE‑2026‑107861 (CVSS 9.9), CVE‑2026‑110243 (CVSS 9.9) and CVE‑2026‑109122 (CVSS 9.1).
Additional issues cover authentication weaknesses, NULL pointer dereference and session handling problems (for example CVE‑2026‑110825, CVE‑2026‑110491, CVE‑2026‑96616, CVE‑2026‑111100), with a notable shared‑secret flaw CVE‑2026‑92450 that would allow forging administrative tokens because the signing secret is identical across all devices. In total, nine CVEs are cited, all affecting Kiloview E3 firmware prior to version 1.30.
The Kiloview E3 turns video feeds into network streams for broadcast and live production, and CISA notes that exploitation could fully compromise the device. The vendor has addressed all nine flaws in firmware version 1.30. Evidence cited includes public advisories and CVE records, with CISA stating no publicly observed exploitation at the time of the advisory.
Affected users are urged to update to V1.30 and to apply mitigations such as keeping the device off the internet, placing it behind a firewall, and using a current VPN for remote access. The advisory document ICSA‑26‑295‑01 provides additional guidance, and owners should treat these vulnerabilities as urgent and apply the update promptly.