Is CVE-2026-94367 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-94367?

CVE-2026-94367 has a CVSS v3 severity of HIGH (7.2).

Back

CVE-2026-94367

Description

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr user. The underlying design has been present since at least firmware 2.2.3.4. Upgrade to version 3.5.4.