CVE Intelligence
Analysis AI-assisted

CVE-2026-9261: Canon EOS Network Setting Tool - Weak SSH Cryptographic Algorithms

CVE-2026-9261 is a weak SSH cryptographic algorithm issue (CWE-327) affecting Canon EOS Network Setting Tool version 1.5.0 or earlier on Windows and macOS, and the generic product range listed as before 1.5.1. NVD assigns a critical base score of 9.8, while Canon's own scores in the record are lower. No confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-9261 is classified as CWE-327, use of a broken or risky cryptographic algorithm. According to the record, the Canon EOS Network Setting Tool uses weak SSH cryptographic algorithms in version 1.5.0 or earlier.

Impact

Weak SSH algorithms can weaken the confidentiality and integrity of sessions that rely on them. NVD scores the issue 9.8 (critical), with high confidentiality, integrity and availability impact. Canon's scores in the record are 6.8 and 7.6, which differ from the NVD score and should be read in the context of each scoring specification.

Affected products and versions

  • Canon Inc. EOS Network Setting Tool: listed as before 1.5.1.
  • EOS Network Setting Tool for macOS: version 1.5.0 or earlier.
  • EOS Network Setting Tool for Windows: version 1.5.0 or earlier.

The record does not explicitly list a fixed version. The range before 1.5.1 suggests that 1.5.1 is the first version outside the listed range, which is an inference.

Exploitation status

The record shows that this CVE is not listed in the CISA KEV catalog. Its SSVC data marks exploitation as none and automatable as no. The EPSS probability is 0.00322, with percentile 0.24017. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Inventory the installed version of the tool on Windows and macOS systems.
  • Update to a version outside the affected range, and consult the Canon advisories linked below for the correct download.
  • Where updating is delayed, restrict network access to the tool's management activity and limit which hosts can reach it.
  • Review SSH configuration for weak algorithms wherever the vendor documentation provides options to do so.

Detection guidance

Maintain an inventory of the tool and its versions across endpoints. Prioritize systems still running version 1.5.0 or earlier, especially those reachable from untrusted networks.

Limitations of the available information

The record does not name the specific weak algorithms, does not explicitly state a fixed version, and provides no details on exploitation conditions. The CVSS scores differ between NVD and Canon. These gaps should be resolved by consulting the vendor advisories.

Frequently asked questions

Which versions of Canon EOS Network Setting Tool are affected?

The record lists the generic product as before 1.5.1, and the macOS and Windows variants as version 1.5.0 or earlier.

Is this vulnerability being actively exploited?

The record shows it is not listed in CISA KEV and that SSVC marks exploitation as none. No confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.