What is CVE-2026-87827?
Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. A remote unauthenticated attacker with network access to the affected service can execute arbitrary system commands on the device, potentially resulting in complete compromise of the DVR. The vulnerability is known to have been exploited in the wild by the Mirai_ptea (Rimasuta) and Mirai_aurora botnets for malware propagation and subsequent DDoS activity. The vulnerability was reported to affect firmware dating from 2016, while firmware released after 2017 appears to mitigate the issue by restricting the affected service to the localhost interface (127.0.0.1) instead of exposing it on all interfaces (0.0.0.0). The affected-device list reported by Netlab includes many D1004NR, D1008NR, D1016NR, D1104, D1104NR, D1108NR, D1116NR, D1132NR, D2116NR, D97xx, D98xx, and D99xx variants and several associated hardware revisions The exploit is included in some version of rapperbot and exploited in 2026. This assignment has been made to document the active exploitation and lack of documentation from the vendor.
The record classifies CVE-2026-87827 under weakness class CWE-1188. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 45 days ago.
Severity and exploitation probability
- CVSS v4.0 base score
- 10 — Critical (derived from score)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - EPSS (FIRST)
- 1.0% probability of exploitation in the next 30 days, higher than 64.0% of all scored CVEs
- CISA KEV
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Threadlinqs priority
- 7.6/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- Published
- 2026-09-09
Is CVE-2026-87827 being exploited?
It currently carries a trending score of 43 in the Threadlinqs vulnerability feed.
Affected products and versions
- KGUARD: KGUARD_firmware
How to fix CVE-2026-87827
No vendor patch reference has been recorded for CVE-2026-87827 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.
Threat activity tracking CVE-2026-87827
2 tracked threats in the Threadlinqs corpus reference CVE-2026-87827, either in the campaign’s CVE list or as an indicator on the campaign record.
Sources
Enriched from CVE.org, FIRST EPSS, GitHub Security Advisories. Last verified by Threadlinqs on .