Critical RCE Vulnerability in Shark Robot Vacuums Exposes Millions to Attack

A severe vulnerability has been identified in Shark robot vacuums, allowing remote command execution (RCE) that could grant attackers root access. The flaw affects millions of Shark RV2320EDUS vacuums due to a misconfigured AWS policy linked to a certificate, enabling unauthorized command execution on devices in the same AWS region. This could lead to unauthorized access to onboard cameras, house maps, and Wi-Fi credentials. The vulnerability was reported by researcher tokay0 in March 2026, but SharkNinja has yet to release a patch, leaving devices exposed. Users are advised to disconnect their vacuums from Wi-Fi until a fix is implemented. The issue highlights the risks associated with IoT devices and the importance of timely security updates.

Key Points: • Millions of Shark robot vacuums are vulnerable to a critical RCE flaw. • The vulnerability allows attackers to access cameras, maps, and Wi-Fi credentials. • No patch has been released despite the flaw being reported in March 2026.