CVE-2026-1241 Authentication Bypass Using an Alternate Path or Channel in Pelco, Inc. Sarix Pro 3 Series IP Cameras
Attackers can bypass authentication to view live video streams on Pelco Sarix Pro 3 cameras, compromising privacy and operational security.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-1241?
CVE-2026-1241 is a high-severity authentication bypass vulnerability in Pelco, Inc. Sarix Professional IBP 3 Series, published on 26 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Pelco, Inc. Sarix Professional 3 Series Cameras are vulnerable to an authentication bypass issue in their web management interface. The flaw stems from inadequate enforcement of access controls, allowing certain functionality to be accessed without proper authentication. This weakness can lead to unauthorized viewing of live video streams, creating privacy concerns and operational risks for organizations relying on these cameras. Additionally, it may expose operators to regulatory and compliance challenges.
Weakness: CWE-288
Which versions are affected by CVE-2026-1241?
How do I fix CVE-2026-1241?
No fix has been published for CVE-2026-1241 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-1241 being exploited?
There is no known exploitation of CVE-2026-1241 in the wild and no public exploit code.
Sources
Also known as GHSA-x79r-7fxv-8xh2.