Blog · 2-hour update · 2026-10-22

CVE-2026-110243 network management service: critical flaw, patch first

Most urgent: CVE-2026-110243: The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network inte
Critical severity (CVSS 9.9). Recommended action: apply the vendor mitigation.

On 22 October 2026, 12 new CVEs were published that we track: 3 critical, 0 already exploited in the wild (CISA KEV) and 0 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.

What happened in this 2-hour window: the most serious item is CVE-2026-110243 (critical, CVSS 9.9, priority 43/100). Recommended action: apply the vendor mitigation. 4 of the 8 top items can be attacked remotely without a login. 0 of 12 new CVEs already have a fix or vendor patch; for the other 12, follow the downgrade or mitigation steps until one ships.

Patch these first

CVE-2026-110243: The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network inte

Critical severity (CVSS 9.9), priority 43/100 (patch this month). Signals: critical severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-107861: The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname paramet

Critical severity (CVSS 9.9), priority 43/100 (patch this month). Signals: critical severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-109122: The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used w

Critical severity (CVSS 9.1), priority 40/100 (patch this month). Signals: critical severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-110491: The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certai

High severity (CVSS 7.5), priority 39/100 (routine). Signals: high severity; remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-110825: The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configura

High severity (CVSS 7.5), priority 38/100 (routine). Signals: high severity; remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-96616: Authentication tokens issued by the E3's web management interface on login are given an expiration time far be

Medium severity (CVSS 6.5), priority 33/100 (routine). Signals: remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-111100: The ONVIF device service on the E3 responds to certain informational requests without requiring authentication

Medium severity (CVSS 5.3), priority 29/100 (routine). Signals: remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-105265: A vulnerability exists in the the time zone parameter and does not properly validate user input, which may all

Medium severity (CVSS 5.3), priority 26/100 (routine). Recommended action: apply the vendor mitigation.

References: NVD

How to act on this list

Start with anything marked exploited or patch now.
Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.

FAQ

What is the most serious vulnerability published on 22 October 2026?

CVE-2026-110243 (The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network inte) ranks highest, with a priority score of 43/100. Recommended action: apply the vendor mitigation.

Are any of the new CVEs exploited in the wild?

None of the new CVEs were on the CISA Known Exploited Vulnerabilities list when this was written. Keep watching the list, it changes daily.

Should I downgrade if there is no fix yet?

Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.

Sources

NIST National Vulnerability Database: CVE details and affected versions
CVE Program: official CVE records
CISA Known Exploited Vulnerabilities catalog: exploitation in the wild
FIRST EPSS: exploit probability
Distribution and vendor advisories linked under each item.

← All posts