What it is
CVE-2026-87827 is an unauthenticated KGUARD DVR unauthenticated remote command execution vulnerability. Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network...
Vulnerability report
Exploitation attempts observed in the wild
High confidence
Not in CISA KEV
CVE-2026-87827
KGUARD DVR unauthenticated remote command execution vulnerability
KGUARD_firmware
- Severity
- CVSS 10.0 · Critical
- Confidence
- High
- Exploit status
- Exploitation attempts observed in the wild
- EPSS
- 1.1%
- First observed
- —
- Last observed
- —
Decision summary
What security teams need to know first
Direct answers before the deeper technical record.
Have exploitation attempts been observed?
Yes. Exploitation attempts have been reported for this vulnerability. Previdian lists it as a known exploited vulnerability. Also reported by third-party sources. Confidence is high.
Who is affected?
KGUARD_firmware.
What should we do?
Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Overview
KGUARD DVR unauthenticated remote command execution vulnerability
Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. A remote unauthenticated attacker with network access to the affected service can execute arbitrary system commands on the device, potentially resulting in complete compromise of the DVR.
The vulnerability is known to have been exploited in the wild by the Mirai_ptea (Rimasuta) and Mirai_aurora botnets for malware propagation and subsequent DDoS activity. The vulnerability was reported to affect firmware dating from 2016, while firmware released after 2017 appears to mitigate the issue by restricting the affected service to the localhost interface (127.0.0.1) instead of exposing it on all interfaces (0.0.0.0).
The affected-device list reported by Netlab includes many D1004NR, D1008NR, D1016NR, D1104, D1104NR, D1108NR, D1116NR, D1132NR, D2116NR, D97xx, D98xx, and D99xx variants and several associated hardware revisions
The exploit is included in some version of rapperbot and exploited in 2026. This assignment has been made to document the active exploitation and lack of documentation from the vendor.
- Published
- 09 Sep 2026
- Exploitation Attempts Reported
- 09 Sep 2026
- Attack vector
- Remote
- Complexity
- Low
- Privileges
- None
- User interaction
- None
Tags
mirai
malware
CVE References
- CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2026-87827
- Technical Description — blog.netlab.360.com blog.netlab.360.com · Technical Description https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclos...
Exploitation evidence
Evidence of exploitation attempts
Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.
Exploitation attempts observed in the wild
CVE
A trusted third party reported exploitation attempts.
Targeted by mirai-related exploitation attempts
CVE
Exploitation attempts against this vulnerability are associated with mirai-related payloads.
Known exploited vulnerability sources
Per-source evidence links for KEV attestations are available through the Previdian Pro API.
Learn about Pro API access| Source | Added |
|---|---|
| CVE First | 2026-09-09 11:01 UTC |
| The Hacker News | 2026-10-05 15:35 UTC |
Detection
Operational artifacts and observed signals
Make the evidence actionable in scanner, SOC, and edge-control workflows.
Scanner coverage
No scanner integrations recorded yet.
Virtual patch status
No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.
Learn about virtual patches →No detection artifacts or sensor request patterns are available for this CVE yet.
Check back as sensor telemetry and scanner integrations are updated.
Risk and context
Severity, weaknesses, and research context
CVSS v4.0
10.0
Critical
Potential damage if exploited. Separate from whether attackers are using it.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
1.1%
Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.
Recent mention · The Hacker News
Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2
Ravie LakshmananOct 05, 2026Vulnerability / Malware Threat actors have been observed attempting to exploit a now-patched critical security flaw impacting the Realtek Jungle software development kit (SDK) to deploy a botnet malware called Cling. "Cling is notable not because...
Read full advisoryTimeline
From disclosure to observed exploitation attempts
-
15:35 UTC
KEV confirmed by The Hacker News
Exploitation attempts reported by an external source
-
11:01 UTC
Targeted by mirai-related exploitation attempts
Malware-related exploitation attempts or payloads reported
-
11:01 UTC
Added to Previdian KEV Feed
High-confidence, third-party report of exploitation attempts
-
10:54 UTC
CVE published
Vulnerability disclosed publicly
-
10:41 UTC
CVE ID reserved
Identifier reserved by the CNA
Pro API
Automate this intelligence
Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.
- Evidence confidence and provenance
- First-party sensor telemetry
- PoC and scanner references
- Affected versions and enrichment
- Automation-ready JSON delivery
GET /api/v2/pro/kevs/CVE-2026-87827
Sample API response{
"cve_id": "CVE-2026-87827",
"confidence": "High",
"cvss_score": 10.0,
"cvss_estimated": false,
"epss_score": 0.0108,
"exploit_status": {
"exploited_in_the_wild": true,
"active_exploitation_observed": false
},
"sensor_telemetry": { "attempts": 0, "sensors": 0 }
}