Vulnerability · Published Jul 27, 2026 · Assigned by INCIBE
CVE-2026-12990Multiple vulnerabilities in Ghost Robotics' Vision 60
High 7.7
In plain English
A high-severity improper access control in Vision 60 from Ghost Robotics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Official description
An access control vulnerability in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows multiple simultaneous sessions to run without proper client validation or session integrity checks. An attacker with a modified version of the app can connect to the robot during an active, legitimate session. This allows the attacker to bypass control restrictions, intercept sensitive information (such as real-time video), and partially interact with the system unnoticed and without disconnecting the legitimate user, compromising confidentiality and operational security.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ghost Robotics | Vision 60 | 5.5.0 |
Weakness: CWE-284 · Vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N