CVE-2026-55726

Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSS 6.9 MEDIUMEPSS 0.4%CWE-497

Vexday Risk Score

33Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS 6.9EPSS 0.4%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

02 Jul 2026Public PoC

02 Jul 2026Published on NVD

Weaponization speed

same dayto first PoC

Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.

Recommendation: Plan a near-term fix — a public PoC already exists.

The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:L

Affected products

Gardyn · Gardyn Cloud API Gardyn · Gardyn Home Firmware Gardyn · Gardyn Studio Firmware

public PoCs found — 1

githubgithub.com/MichaelAdamGroberman/CVE-2026-55726★ 0

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-183-03.json https://mygardyn.com/security/https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-03