CVE-2026-9259 is a medium severity flaw (CVSS 6.5) in Canon EOS Network Setting Tool version 1.5.0 and earlier, on Windows and macOS. The tool does not properly validate server certificates. Update to the fixed release named in Canon's advisory CP2026-005, which the record does not spell out.
What's affected
- Product: Canon EOS Network Setting Tool, on Windows and macOS according to the record.
- Affected versions: 1.5.0 and earlier.
- Fixed version: the record does not name one. Canon's advisory CP2026-005 is the place to confirm the release that fixes it.
- Severity: CVSS 6.5, medium. The record does not mark it as exploited.
How to check if you're exposed
Open the tool on each Windows and macOS machine that has it and read the version from its About or version screen. Anything at 1.5.0 or earlier is in scope. If you manage a fleet, your software inventory or endpoint tooling can list installed copies of the application by name.
What to do now
- Read Canon's advisory CP2026-005 and note the fixed version of the EOS Network Setting Tool.
- Update every installed copy to that version, or remove the tool from machines that no longer need it.
- Until you have updated, use the tool only on networks you trust.
- Add the tool to your software inventory so the next advisory is easy to scope.
Why it matters
The record lists CWE-295. Certificate validation is how a TLS client decides that a server is who it claims to be. When the check is incomplete, a person on the network path can present a certificate that should have been rejected and sit between the tool and the server. The vector shows network access, no privileges and a user action, with a high confidentiality impact.
This is a medium severity issue and it does not put a server at risk by itself. It matters because the tool is used to configure cameras on a network, and settings or credentials that pass through a weakly protected channel are worth protecting. Patch it with your next round of application updates.
Quick check
Is this the same issue as the SSH host key CVE?
No. CVE-2026-9258 covers SSH host keys and this one covers server certificates. Both share a CWE and an advisory, so check Canon's notice to confirm what the fixed version covers.
Sources
- Canon PSIRT advisory CP2026-005 (listed in the CVE record; the page blocked automated access when this post was reviewed, so confirm the fixed version there)
- Canon USA notice CPA2026-005
- Canon Japan support notice
- Gold entry for CVE-2026-9259
Last reviewed: 19 October 2026.
