Kiloview E3 NDI Encoder Insufficient Session Expiration

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

• vendor Kiloview E3 Firmwareversion unspecified

How to fix CVE-2026-96616

• No stored fix

  No vendor fix text is stored. Use the linked advisory before you change production.

• Version check

  No version range is stored, so an installed version cannot be checked on this page.

• Advisory

  Open the cisa_advisories record and follow its fix.

• Official advisories

  • CISA Cybersecurity Advisories · cisa.gov
  • CISA ICS Advisories · cisa.gov
  • CVE.org · cve.org
  • FIRST EPSS · first.org

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Oct 22, 2026 · CISA ICS Advisories

   Detected

   CVE-2026-96616 is listed by Kiloview E3 NDI Encoder.

2. Oct 22, 2026 · CVE.org

   Updated

   Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extended period.

Sources

• CISA Cybersecurity AdvisoriesGovernment advisoryCVE-2026-96616

  View CSAF Summary Successful exploitation of this these vulnerabilities could allow an attacker to fully compromise the device. The following versions of Kiloview E3 NDI Encoder are affected: E3 Firmware <table class="tablesaw ta

  cisa.gov
• CISA ICS AdvisoriesGovernment advisoryCVE-2026-96616

  View CSAF Summary Successful exploitation of this these vulnerabilities could allow an attacker to fully compromise the device. The following versions of Kiloview E3 NDI Encoder are affected: E3 Firmware <table class="tablesaw ta

  cisa.gov
• CVE.orgVulnerability recordCVE-2026-96616

  Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated acc

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-96616

  30-day exploitation probability 0.37%

  first.org

References

• Reference · github.com
• Reference · cisa.gov
• Reference · kiloview.com

Freshness

Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

• CISA Cybersecurity AdvisoriesNov 6, 2026
• CISA ICS AdvisoriesNov 6, 2026
• FIRST EPSSOct 28, 2026
• CVE.orgOct 23, 2026