CVE-2026-9261 is a medium severity flaw (CVSS 6.8) in Canon EOS Network Setting Tool version 1.5.0 and earlier, on Windows and macOS. The tool uses weak SSH cryptographic algorithms. Update to the fixed release named in Canon's advisory CP2026-005, which the record does not spell out.
What's affected
- Product: Canon EOS Network Setting Tool, on Windows and macOS according to the record.
- Affected versions: 1.5.0 and earlier.
- Fixed version: the record does not name one. Canon's advisory CP2026-005 is the place to confirm the release that fixes it.
- Severity: CVSS 6.8, medium. The record does not mark it as exploited.
How to check if you're exposed
Open the tool on each Windows and macOS machine that has it and read the version from its About or version screen. Anything at 1.5.0 or earlier is in scope. If you manage a fleet, your software inventory or endpoint tooling can list installed copies of the application by name.
What to do now
- Read Canon's advisory CP2026-005 and note the fixed version of the EOS Network Setting Tool.
- Update every installed copy to that version, or remove the tool from machines that no longer need it.
- Until you have updated, use the tool only on networks you trust.
- Add the tool to your software inventory so the next advisory is easy to scope.
Why it matters
The record lists CWE-327. Old or broken algorithms can be attacked even when the protocol around them looks correct. The vector rates attack complexity as high, needs a user action, and scores high for both confidentiality and integrity, which is why it sits slightly above the other Canon entries at 6.8.
This is a medium severity issue and it does not put a server at risk by itself. It matters because the tool is used to configure cameras on a network, and settings or credentials that pass through a weakly protected channel are worth protecting. Patch it with your next round of application updates.
Quick check
Can I fix this by changing a setting?
The record and the advisory titles do not describe a setting that changes the algorithms. Update the tool to the fixed version and check Canon's notice for any extra steps.
Sources
- Canon PSIRT advisory CP2026-005 (listed in the CVE record; the page blocked automated access when this post was reviewed, so confirm the fixed version there)
- Canon USA notice CPA2026-005
- Canon Japan support notice
- Gold entry for CVE-2026-9261
Last reviewed: 19 October 2026.
