CVE-2026-96616
E3 Firmware: Kiloview E3 NDI Encoder Insufficient Session Expiration
Kiloview E3 Firmware
CVSS
6.5MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 21% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.30E3 FirmwareCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Reports 1
1 outlet mention it. Reports are not confirmation; each links to its source.
Description
Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extended period.
Text from CVE List
Affected versions 2
- E3 Firmwareaffected: all versions before 1.30CVE List
- E3 Firmwareunaffected: 1.30CVE List