--- title: "Philips vulnerabilities: CVEs, CISA KEV and security advisories" url: https://radicalnotion.ai/vendor/philips type: vendor description: "Philips has 125 published CVEs, 2 in CISA KEV and 17 with public exploits." updated: 2026-03-13 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # Philips vulnerabilities - **Published CVEs:** 125 - **In CISA KEV:** 2 - **With a public exploit:** 17 - **With a patch:** 48 - **Average CVSS:** 7.1 - **CVEs in the last two years:** 17 - **First CVE:** 2008-10-31 - **Latest CVE:** 2026-03-13 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 14 | | High | 56 | | Medium | 49 | | Low | 6 | | Unscored | 0 | ## Most affected products | Product | CVEs | | --- | --- | | [IntelliSpace Portal](https://radicalnotion.ai/vendor/philips/intellispace-portal) | 14 | | [patient information center ix](https://radicalnotion.ai/vendor/philips/patient-information-center-ix) | 11 | | [e-alert firmware](https://radicalnotion.ai/vendor/philips/e-alert-firmware) | 10 | | [hue bridge v2](https://radicalnotion.ai/vendor/philips/hue-bridge-v2) | 9 | | [e-Alert Unit (non-medical device)](https://radicalnotion.ai/vendor/philips/e-alert-unit-non-medical-device) | 9 | | [hue bridge v2 firmware](https://radicalnotion.ai/vendor/philips/hue-bridge-v2-firmware) | 9 | | [Philips IntelliSpace Portal](https://radicalnotion.ai/vendor/philips/philips-intellispace-portal) | 9 | | [Vue PACS](https://radicalnotion.ai/vendor/philips/vue-pacs) | 9 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-798](https://radicalnotion.ai/cwe/cwe-798) | Use of Hard-coded Credentials | 7 | | [CWE-122](https://radicalnotion.ai/cwe/cwe-122) | Heap-based Buffer Overflow | 6 | | [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 6 | | [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 5 | | [CWE-200](https://radicalnotion.ai/cwe/cwe-200) | Exposure of Sensitive Information to an Unauthorized Actor | 5 | | [CWE-287](https://radicalnotion.ai/cwe/cwe-287) | Improper Authentication | 5 | | [CWE-326](https://radicalnotion.ai/cwe/cwe-326) | Inadequate Encryption Strength | 4 | | [CWE-310](https://radicalnotion.ai/cwe/cwe-310) | Cryptographic Issues | 4 | ## Assigning CNAs | CNA | CVEs | | --- | --- | | [icscert](https://radicalnotion.ai/cna/icscert) | 90 | | [mitre](https://radicalnotion.ai/cna/mitre) | 15 | | [zdi](https://radicalnotion.ai/cna/zdi) | 8 | | [certcc](https://radicalnotion.ai/cna/certcc) | 4 | | [Philips](https://radicalnotion.ai/cna/philips) | 3 | | [microsoft](https://radicalnotion.ai/cna/microsoft) | 2 | | [VulnCheck](https://radicalnotion.ai/cna/vulncheck) | 1 | | [checkpoint](https://radicalnotion.ai/cna/checkpoint) | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2019 | 10 | | 2020 | 24 | | 2021 | 11 | | 2022 | 12 | | 2023 | 1 | | 2024 | 1 | | 2025 | 9 | | 2026 | 8 | ## Latest CVEs | CVE | Title | Severity | CVSS | EPSS | CISA KEV | Published | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-3562 | Philips Hue Bridge hk\_hap Ed25519 Signature Verification Authentication Bypass Vulnerability | high | 8.8 | 0.3% | No | 2026-03-13 | | CVE-2026-3561 | Philips Hue Bridge hk\_hap characteristics Heap-based Buffer Overflow Remote Code Execution Vulnerability | high | 8.0 | 0.6% | No | 2026-03-13 | | CVE-2026-3560 | Philips Hue Bridge HomeKit hk\_hap\_pair\_storage\_put Heap-based Buffer Overflow Remote Code Execution Vulnerability | high | 8.8 | 0.6% | No | 2026-03-13 | | CVE-2026-3559 | Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass Vulnerability | high | 8.1 | 0.5% | No | 2026-03-13 | | CVE-2026-3558 | Philips Hue Bridge HomeKit Accessory Protocol Transient Pairing Mode Authentication Bypass Vulnerability | high | 8.1 | 0.5% | No | 2026-03-13 | | CVE-2026-3557 | Philips Hue Bridge hap\_pair\_verify\_handler Sub-TLV Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability | high | 8.0 | 0.6% | No | 2026-03-13 | | CVE-2026-3556 | Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow Remote Code Execution Vulnerability | high | 8.8 | 0.6% | No | 2026-03-13 | | CVE-2026-3555 | Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability | high | 8.0 | 0.4% | No | 2026-03-13 | | CVE-2020-36872 | BACnet Test Server 1.01 Malformed BVLC Length DoS | high | 8.7 | 0.5% | No | 2025-11-26 | | CVE-2025-27953 | - | medium | 6.5 | 0.4% | No | 2025-06-02 | | CVE-2025-27954 | - | medium | 6.5 | 0.4% | No | 2025-06-02 | | CVE-2025-27955 | - | medium | 6.5 | 0.4% | No | 2025-06-02 | ## Frequently asked questions ### How many CVEs does Philips have? Philips has 125 published CVE records since 2008, including 17 in the last two years. ### How many Philips CVEs are in CISA KEV? 2 of Philips's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline. ### Which Philips products have the most CVEs? The Philips products with the most published CVEs are IntelliSpace Portal, patient information center ix, e-alert firmware, hue bridge v2, e-Alert Unit (non-medical device). ### What are the most common weakness types in Philips CVEs? Philips's CVEs most often map to these CWE weakness types: CWE-798 (Use of Hard-coded Credentials), CWE-122 (Heap-based Buffer Overflow), CWE-20 (Improper Input Validation), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')). ### Are there public exploits for Philips vulnerabilities? Yes — 17 of Philips's CVEs have a known public exploit. ### How many critical Philips vulnerabilities are there? Philips has 14 critical and 56 high-severity CVEs. ### What is the average severity of Philips CVEs? The average CVSS base score across Philips's scored CVEs is 7.1. ## Related vendors - [Accellion](https://radicalnotion.ai/vendor/accellion) (126 CVEs) - [Axis Communications](https://radicalnotion.ai/vendor/axis) (126 CVEs) - [Johnson Controls](https://radicalnotion.ai/vendor/johnson-controls) (126 CVEs) - [libming](https://radicalnotion.ai/vendor/libming) (126 CVEs) - [Webmin](https://radicalnotion.ai/vendor/webmin) (125 CVEs) - [bPlugins](https://radicalnotion.ai/vendor/bplugins) (125 CVEs) - [Mambo](https://radicalnotion.ai/vendor/mambo) (125 CVEs) - [vadz](https://radicalnotion.ai/vendor/vadz) (125 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/philips). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.