CVE-2026-9260 is a medium severity flaw (CVSS 6.2) in Canon EOS Network Setting Tool version 1.5.0 and earlier, on Windows and macOS. The tool uses hard-coded cryptographic keys. Update to the fixed release named in Canon's advisory CP2026-005, which the record does not spell out.
What's affected
- Product: Canon EOS Network Setting Tool, on Windows and macOS according to the record.
- Affected versions: 1.5.0 and earlier.
- Fixed version: the record does not name one. Canon's advisory CP2026-005 is the place to confirm the release that fixes it.
- Severity: CVSS 6.2, medium. The record does not mark it as exploited.
How to check if you're exposed
Open the tool on each Windows and macOS machine that has it and read the version from its About or version screen. Anything at 1.5.0 or earlier is in scope. If you manage a fleet, your software inventory or endpoint tooling can list installed copies of the application by name.
What to do now
- Read Canon's advisory CP2026-005 and note the fixed version of the EOS Network Setting Tool.
- Update every installed copy to that version, or remove the tool from machines that no longer need it.
- Until you have updated, use the tool only on networks you trust.
- Add the tool to your software inventory so the next advisory is easy to scope.
Why it matters
The record lists CWE-321 and CWE-798. A key that is built into the software is the same key on every installation. Anyone who extracts it from one copy can use it against all of them, which defeats the point of encrypting anything with it. Unlike the other Canon entries, the vector here is local access, so an attacker would need a foothold on the machine or access to its files first.
This is a medium severity issue and it does not put a server at risk by itself. It matters because the tool is used to configure cameras on a network, and settings or credentials that pass through a weakly protected channel are worth protecting. Patch it with your next round of application updates.
Quick check
Why is the score lower than the other Canon CVEs?
The vector is local rather than network, with no privileges or user action needed once the attacker has local access, and the impact is limited to confidentiality. That keeps the score at 6.2.
Sources
- Canon PSIRT advisory CP2026-005 (listed in the CVE record; the page blocked automated access when this post was reviewed, so confirm the fixed version there)
- Canon USA notice CPA2026-005
- Canon Japan support notice
- Gold entry for CVE-2026-9260
Last reviewed: 19 October 2026.
