CISA Advisory ICSA-26-106-03: Anviz Multiple Products Vulnerabilities Summary

Anviz Multiple Product Vulnerability Summary Vulnerability Overview Release Date: April 16, 2026 Alert Code: ICSA-26-106-03 CVSS Score: 9.8 (Critical) Risk Description: Successful exploitation of these vulnerabilities may allow an attacker to conduct reconnaissance, capture or decrypt sensitive data, alter device configurations, obtain unauthorized (administrative or root-level) access, execute arbitrary code, compromise credentials or communications, and ultimately gain full control over the affected devices. Vulnerability Types: Including missing authorization, missing authentication for critical functions, command injection, download of code without integrity check, hardcoded keys, relative path traversal, cleartext transmission of sensitive information, improper verification of communication source, use of weak algorithms, etc. Impact Scope Affected Vendor: Anviz Affected Products: Anviz Multiple Products Affected Firmware Versions: CX2 Lite Firmware (CVE-2026-32648, CVE-2026-40461, CVE-2026-35682, CVE-2026-35546, CVE-2026-40066, CVE-2026-33569) CX7 Firmware (CVE-2026-33093, CVE-2026-35061, CVE-2026-32648, CVE-2026-40461, CVE-2026-35546, CVE-2026-40066, CVE-2026-32324, CVE-2026-31927, CVE-2026-33569) CrossChex Standard (CVE-2026-40434, CVE-2026-32650) Critical Infrastructure Sectors: Commercial facilities, critical manufacturing, defense industrial base, energy, financial services, food and agriculture, government facilities and services, healthcare and public health, information technology, transportation systems. Deployment Regions: Global. Remediation Measures Vendor Recommendation: CISA advises users to take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specific Recommendations: Minimize network exposure of all control system devices and/or systems, ensuring they cannot be accessed from the Internet. Place control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure communication methods such as virtual private networks (VPN), and ensure the VPN is updated to the latest version. Conduct appropriate impact analysis and risk assessment before deploying defensive measures. Implement recommended cybersecurity strategies to proactively defend ICS assets. Refer to technical information document ICS-TIP-12-146-01B on the CISA ICS webpage for additional mitigation guidance and recommended practices. Current Status: As of now, CISA has not received any publicly reported exploits specifically targeting these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

CISA Advisory ICSA-26-106-03: Anviz Multiple Products Vulnerabilities Summary