Critical RCE Vulnerability in Shark Robot Vacuums Exposes Millions to Attack

Feeds.Feedburner

Critical RCE Vulnerability in Shark Robot Vacuums Exposes Millions to Attack

First seen 16 Jul 2026, 23:17 UTC • •69.9

Article Content

1 / 5

Browse articles

ThreatCluster •July 17, 2026 at 21:53 UTC

•Millions of Shark robot vacuums are vulnerable to a critical RCE flaw.
•The vulnerability allows attackers to access cameras, maps, and Wi-Fi credentials.
•No patch has been released despite the flaw being reported in March 2026.

A severe vulnerability has been identified in Shark robot vacuums, allowing remote command execution (RCE) that could grant attackers root access. The flaw affects millions of Shark RV2320EDUS vacuums due to a misconfigured AWS policy linked to a certificate, enabling unauthorized command execution on devices in the same AWS region. This could lead to unauthorized access to onboard cameras, house maps, and Wi-Fi credentials. The vulnerability was reported by researcher tokay0 in March 2026, but SharkNinja has yet to release a patch, leaving devices exposed. Users are advised to disconnect their vacuums from Wi-Fi until a fix is implemented. The issue highlights the risks associated with IoT devices and the importance of timely security updates.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 112d ago How this analysis works

Timeline

2026-03-01

Vulnerability reported to SharkNinja

Researcher tokay0 disclosed a critical RCE flaw affecting Shark robot vacuums, highlighting security risks.

Feeds.Feedburner

2026-07-16

Public disclosure of vulnerability

The vulnerability was made public, revealing the potential for remote command execution on millions of devices.

2026-07-16

Advisory to disconnect devices

Users are advised to disconnect their Shark vacuums from Wi-Fi until a server-side patch is released.

Feeds.Feedburner

More articles in this cluster (4)

Threat Graph

5 entities, 4 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Zero-day Exploit

Organization (2)

SharkNinja
AWS

Weakness (2)

CWE-200 - Exposure of Sensitive Information
CWE-287 - Improper Authentication

Relationships

Zero-day Exploit related to SharkNinja
Zero-day Exploit related to AWS
Zero-day Exploit related to CWE-200 - Exposure of Sensitive Information
Zero-day Exploit related to CWE-287 - Improper Authentication

Following this threat?

Track SharkNinja in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical RCE Vulnerability in Prefab UI Disclosed A critical remote code execution vulnerability, CVE-2026-120338, was disclosed on November 1, 2026, affecting Prefab UI's Generative UI sandbox. The flaw allows attackers to execute arbitrary Python code by exploiting Deno's permissions, enabling file read/write access on the host server. This vulnerability affects…

Chinese Actor Compromises US Government Networks via PHP2Shell Exploit A suspected Chinese nation-state actor exploited vulnerabilities in Palo Alto Networks firewalls using a chained PHP2Shell exploit and a Linux kernel privilege escalation flaw. The attack, which began on October 23, targeted 25 servers across the US, Japan, Taiwan, and South Korea, with a focus on US…