Skip to content
Critical RCE Vulnerability in Shark Robot Vacuums Exposes Millions to Attack

Critical RCE Vulnerability in Shark Robot Vacuums Exposes Millions to Attack

First seen 16 Jul 2026, 23:17 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •July 17, 2026 at 21:53 UTC
  • •Millions of Shark robot vacuums are vulnerable to a critical RCE flaw.
  • •The vulnerability allows attackers to access cameras, maps, and Wi-Fi credentials.
  • •No patch has been released despite the flaw being reported in March 2026.

A severe vulnerability has been identified in Shark robot vacuums, allowing remote command execution (RCE) that could grant attackers root access. The flaw affects millions of Shark RV2320EDUS vacuums due to a misconfigured AWS policy linked to a certificate, enabling unauthorized command execution on devices in the same AWS region. This could lead to unauthorized access to onboard cameras, house maps, and Wi-Fi credentials. The vulnerability was reported by researcher tokay0 in March 2026, but SharkNinja has yet to release a patch, leaving devices exposed. Users are advised to disconnect their vacuums from Wi-Fi until a fix is implemented. The issue highlights the risks associated with IoT devices and the importance of timely security updates.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 65d ago How this analysis works

Timeline

2026-03-01
Vulnerability reported to SharkNinja
Researcher tokay0 disclosed a critical RCE flaw affecting Shark robot vacuums, highlighting security risks.
Feeds.Feedburner
2026-07-16
Public disclosure of vulnerability
The vulnerability was made public, revealing the potential for remote command execution on millions of devices.
Gbhackers
2026-07-16
Advisory to disconnect devices
Users are advised to disconnect their Shark vacuums from Wi-Fi until a server-side patch is released.
Feeds.Feedburner

More articles in this cluster (4)

Following this threat?

Track SharkNinja in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 3