Is Your Security Camera on CISA's Vulnerability List? How to Check in 2026

Yes, it's possible — and the fastest way to find out is to check your camera's exact brand and model against the free public advisories the Cybersecurity and Infrastructure Security Agency (CISA) publishes at cisa.gov/ics-advisories. In 2026 alone, CISA has issued at least seven separate advisories covering security camera flaws from major and mid-size brands, and several of those flaws score 9.8 out of 10 — near the top of the CVSS severity scale. Checking takes about five minutes and costs nothing.

What is a CISA advisory, and why do security cameras keep showing up on it?

CISA is the U.S. government agency responsible for warning the public about flaws in widely used hardware and software, including the internet-connected devices inside homes. When a researcher or vendor discovers a security hole in a product, CISA can publish an advisory describing exactly which models and firmware versions are affected, how bad the flaw is on the 0-to-10 CVSS severity scale, and what to do about it.

Security cameras are frequent targets for this kind of disclosure because many are built cheaply, run outdated software, and are designed to be reachable from outside the home network for remote viewing — a combination that creates opportunities for flaws to slip through.

Which camera brands had CISA advisories in 2026?

Camera-specific advisories have landed almost every month this year. A few notable ones:

• Swann SWIFI-SE2KIC — three flaws letting an attacker on the local network view live video and snapshots without logging in, disclosed by CISA on October 13, 2026 (CVSS 6.2).
• Honeywell HIB2PI and HDZ Series CCTV cameras — a missing-authentication flaw rated 9.8 out of 10 in a 2026 CISA advisory, allowing account takeover and unauthorized feed access.
• Milesight cameras — authorization bypass, hard-coded credentials, and command injection, also scored 9.8 in a 2026 CISA advisory.
• AVer PTC cameras — a flaw enabling arbitrary code execution, rated 9.8 in a 2026 CISA advisory.
• Brickcom cameras — remote, unauthenticated access to live video feeds, rated 7.7 in a 2026 CISA advisory.
• Pelco Sarix Pro 3 Series IP cameras — authentication bypass, rated 7.5 in a 2026 CISA advisory.
• KMW CCTV cameras — a flaw letting an attacker remotely reset the administrator password without authentication, rated 9.1 in a May 2026 CISA advisory.

CISA has flagged at least seven camera brands in 2026 — several with CVSS scores of 9.8, near the top of the severity scale.

These aren't the only examples outside the CISA pipeline, either. Independent researchers also disclosed vulnerabilities in TP-Link's consumer Tapo C325WB camera in 2026, including an authorization bypass (CVE-2026-105672) rated 8.7 that could expose live video and let an attacker change device settings, according to a security research writeup. TP-Link shipped a firmware fix for that one.

How do I check if my own camera is affected?

You don't need technical skills — just your camera's exact model number and current firmware version, both usually visible in the camera's companion app under "device info" or "about."

• Find your model and firmware version
• Search it on CISA's advisory page
• Check for a newer firmware release
• Update immediately if available

Most advisories, including the Swann one above, note that the flaw requires an attacker to already be on your local network or that the device is exposed directly to the internet through port forwarding — so checking your router's port-forwarding and remote-access settings is worth doing at the same time.

Why do so many cameras ship with these flaws?

The Federal Trade Commission has long warned that the biggest risk to a home camera isn't a sophisticated hack — it's a default or reused password that's easy to find online, combined with a camera that was never designed to receive ongoing security updates after it shipped. The FTC's broader guidance on securing internet-connected devices at home recommends changing default credentials immediately and keeping firmware current, precisely because so many smart-home products stop getting patches once a newer model replaces them on store shelves.

What should you do if your camera is on the list?

If a current advisory covers your model, update the firmware right away using the link in the advisory or your manufacturer's official app or site. If no fix exists yet, most advisories — including the Swann one — recommend keeping the camera off the public internet: no port forwarding, no DMZ exposure, and no direct public IP access, so it's only reachable from inside your own network.

Is there a lower-risk way to add a camera without this headache?

One reason this keeps happening is that every new camera is a new piece of hardware running its own, often neglected, software stack. A phone you already own is a different story: iOS and Android devices receive regular security patches directly from Apple and Google, the same update cadence you likely already rely on for your primary phone. That's part of why apps like iCameraPlus — which turn a spare phone into a continuously recording camera with footage saved to a private cloud archive you access from a web panel — appeal to people who'd rather not add another unmonitored device to their home network. If you're weighing a dedicated camera purchase against repurposing a phone already in your drawer, our guide on whether a new camera is worth it versus an old phone walks through the tradeoffs, and our home security camera overview covers placement and setup basics either way.

Quick answers

Does a CISA advisory mean my camera has already been hacked? No. An advisory means researchers found a flaw that could be exploited under certain conditions — it's a warning to patch, not proof of an active break-in.

How do I find my camera's current firmware version? Open the camera's companion app and look under "device info," "about," or "settings" — most manufacturers also let you check and update firmware from the same screen.

Should I throw away a camera that's on an advisory? Usually not — most flaws are fixed with a firmware update or by removing the camera's direct internet exposure. Check the specific advisory for CISA's recommended mitigation before deciding to replace the device.

Sources

• CISA: Swann Communications SWIFI-SE2KIC advisory (ICSA-26-286-02, 2026)
• CISA: Honeywell HIB2PI and HDZ Series CCTV Cameras advisory (ICSA-26-048-04, 2026)
• CISA: Milesight Cameras advisory (ICSA-26-113-03, 2026)
• CISA: AVer PTC Cameras advisory (ICSA-26-169-01, 2026)
• CISA: Brickcom Cameras advisory (ICSA-26-162-03, 2026)
• CISA: Pelco, Inc. Sarix Pro 3 Series IP Cameras advisory (ICSA-26-057-02, 2026)
• CISA: KMW CCTV Security Cameras advisory (ICSA-26-148-06, 2026)
• Security Online: Critical Tapo C325WB Vulnerabilities Expose Smart Cameras (2026)
• FTC Consumer Advice: How To Secure Your Home Security Cameras
• FTC Consumer Advice: Securing Your Internet-Connected Devices at Home