Saudi NCA Warns of High-Severity Flaw in Hikvision HikCentral Access Control
On 10 September 2026, the CERT team of Saudi Arabia’s National Cybersecurity Authority (NCA) issued alert No. 2026-7835, titled “Hikvision Alert”, with a severity rating of High. It concerns a Hikvision HikCentral vulnerability in HikCentral Access Control, Hikvision’s platform for managing access control systems. The NCA recommends updating affected products following the manufacturer’s guidance.
The CVE record for the flaw, CVE-2026-85545, was published the same day and sets out the affected versions and the nature of the weakness. Below we report only what the official sources say, then explain what it means for Saudi sites that run their doors and gates through this platform.
Key takeaways
- NCA alert No. 2026-7835 was issued on 10 September 2026 with a High severity rating.
- CVE-2026-85545 lists HikCentral Access Control V2.5.0 and earlier as affected.
- The flaw: an authenticated low-privilege user can call API interfaces their role is not authorized to use. It scores 7.1 (High) under CVSS 3.1.
- The NCA advises reviewing Hikvision’s security advisory and updating affected products through the link the vendor published.
- The sources we reviewed do not state the fixed version, so take the correct version from Hikvision’s own advisory.
What do the NCA alert and the CVE record say?
The NCA alert, in both its Arabic and English versions, states that Hikvision has released security updates to fix a vulnerability in its products, and links to Hikvision’s support page for the HikCentral Access Control vulnerability. It lists the targeted sectors as energy, media, manufacturing, healthcare, transportation, water and utilities, commercial facilities and defence. The alert does not give version numbers or the CVE ID; those details are in the CVE record.
CVE-2026-85545 was published on 10 September 2026 with Hikvision as the assigning CNA. OpenCVE describes it as follows:
| Item | What the record states |
|---|---|
| Product | Hikvision HikCentral Access Control |
| Affected versions | V2.5.0 and earlier |
| Weakness | An authenticated low-privilege user can call API interfaces their role is not allowed to access |
| Classification | CWE-284 (Improper Access Control) and CWE-285 (Improper Authorization) |
| Score | CVSS 3.1: 7.1 (High); network attack, low privileges required, no user interaction |
| Fixed version | Not stated in the sources we reviewed; check Hikvision’s advisory |
In practice, the risk does not come from an unknown outsider. It comes from an account that already exists on the platform with limited rights, such as a reception or security operator login. The score indicates a high impact on confidentiality and a low impact on integrity.
What does this mean for Saudi Arabia?
HikCentral Access Control is used to manage door controllers, face and fingerprint terminals and gates from one screen. It usually holds employee and visitor records, entry and exit logs and access schedules. The sectors named in the alert, such as healthcare, manufacturing, energy and commercial facilities, are the same ones that rely on this kind of system at entrances and restricted areas.
The alert does not mention any incident in the Kingdom; its purpose is prevention. Because the flaw sits in the central software rather than in the field devices, a site can stay exposed even when its locks and terminals work normally. It is good practice for the IT manager to record when the alert was reviewed and what action was taken.
AZEIDK Expert Take
If your site manages doors or gates through HikCentral Access Control, start with four steps. First, check the installed version with your system administrator or in the platform interface; V2.5.0 or earlier falls within the CVE record. Second, open Hikvision’s advisory from the link the NCA referenced and update to the version Hikvision specifies, after backing up the database and scheduling the update so it does not disrupt entrance operation. Third, until the update is complete, restrict access to the platform server so it is not reachable from the internet, review user accounts, remove unused ones, and cut low-privilege roles down to what each role actually needs. Fourth, monitor platform logs and API requests for unusual activity from limited accounts. These interim steps are general good practice, not part of the alert text.
AZEIDK supplies Hikvision access control devices as part of its security and surveillance systems, and offers a programming and systems integration service to configure devices and connect them to the platform after the update. For the reader and credential options available, see our guide to access control technologies, and on why firmware should come from the official source, see the news item on ZKTeco’s warning about an unauthorized website. For questions about Hikvision devices on your site, talk to the AZEIDK team.
Sources
- Hikvision Alert, No. 2026-7835, National Cybersecurity Authority, 10 September 2026
- تنبيه Hikvision, No. 2026-7835 (in Arabic), National Cybersecurity Authority, 10 September 2026
- CVE-2026-85545: HikCentral Access Control, OpenCVE (record assigned by Hikvision), 10 September 2026
- Security Vulnerability in HikCentral Access Control, Hikvision, the advisory referenced by the NCA alert
