Is CVE-2021-36260 (Hikvision Improper Input Validation) being exploited in the wild?

Yes. CISA added CVE-2021-36260 to its Known Exploited Vulnerabilities catalogue on 10 January 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. A command injection vulnerability in the web server of some Hikvision product. Any organisation running the affected product should treat remediation as urgent.

How to interpret “being exploited in the wild” for this CVE

For a vulnerability question like this, the useful distinction is not whether the flaw exists, but whether there is credible evidence that attackers are already using it against real systems. CISA’s KEV listing is the operational signal that matters because it is reserved for issues with confirmed exploitation, not just theoretical risk or proof-of-concept attention.

That makes the right response posture different from an ordinary CVE review. If your environment includes the affected Hikvision product, treat the issue as an active exposure, not a watchlist item. The practical decision is whether the product is internet-exposed, reachable by management interfaces, or present in third-party-managed environments where your team may not see the full device inventory.

What this means for affected Hikvision deployments

The immediate concern is command injection in a web server path, which means the vulnerable interface can become an execution path if it is reachable and not adequately constrained. In operational terms, that raises the value of reducing exposure first, then validating whether the device is actually in service, reachable, and owned by the right support team.

If a device cannot be remediated immediately, the next-best step is to narrow the attack surface as much as possible: isolate the device, restrict management access, and remove any unnecessary external exposure. For products that sit in branch networks, physical security systems, or vendor-managed estates, the risk is often underestimated because the asset is treated as infrastructure rather than as an internet-capable application endpoint.

How to respond before and after remediation

The response sequence should be driven by two questions: can the vulnerable system still be reached, and has it already been used as an initial foothold? That means checking logs, authentication activity, nearby network devices, and any unexpected configuration changes, not just confirming that a patch has been installed.

Where a device had broad management access, review whether its credentials, sessions, or adjacent administrative accounts could have been exposed through compromise. IoT Security Guide is useful here because IP cameras and similar devices are often deployed with weak segmentation and long-lived management access, which turns a local device flaw into a wider network risk.

Risk and Threat Considerations

This vulnerability is materially risky because confirmed exploitation means attackers may already be scanning for reachable Hikvision deployments, especially those exposed for remote viewing or central management. In that situation, the main concern is not only device compromise, but also the possibility that the device is used as an entry point into a broader network segment.

Failure mechanism: Command injection in a web server gives an attacker a path from a request to code execution or privileged device actions when the interface is reachable and insufficiently constrained.

Impact: A compromised device can enable surveillance disruption, configuration tampering, foothold establishment, and lateral movement into adjacent systems if the device is trusted inside a larger environment.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation makes prioritised vulnerability handling central.
Recommendation — Prioritise exposed Hikvision systems for remediation and verify closure with rescanning.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The question is about exploited software flaws and urgent correction.
	RA-5 — Vulnerability Monitoring and Scanning	Exposure confirmation and post-remediation validation depend on vulnerability assessment.
Recommendation — Track, correct, and verify remediation for the affected device promptly. Scan for vulnerable Hikvision assets and confirm remediation status after action.
OWASP ASVS	V15 — Secure Coding and Architecture	The underlying issue is improper input handling leading to command injection.
	V13 — Configuration	Device hardening and reachable management surfaces affect exploitability.
Recommendation — Review input-handling paths and command execution boundaries for injection exposure. Reduce exposed management interfaces and harden device configuration.

Practitioner Guidance

What to prioritise: Confirm whether the device is internet-facing or reachable from untrusted networks, then move to exposure reduction before waiting for a maintenance window. For remotely managed camera estates, reachability often matters more than patch scheduling because an exposed management path remains an active attack surface.

What to verify: Validate whether the device has any unusual outbound traffic, unexpected admin logins, changed settings, or newly created accounts or services. If the device supports exporting audit or event data, preserve that evidence before rebooting or reimaging it.

Practitioner takeaway: Treat KEV inclusion as an exploitation signal, not a research signal, and use it to trigger both remediation and compromise assessment when the vulnerable product is operationally important.