Follow-up to my February PSA: two federal updates landed July 2, 2026
Quick update for anyone who saw my earlier post about the CISA advisory covering our favorite device and the infrastructure it's connected to.
Two things happened on July 2, and one of them is worth understanding even though — same as last time — there's nothing you need to install.
What's new:
A second advisory, ICSA-26-183-03, was published covering the Gardyn "IoT Hub" (the cloud service that manages the devices). It lists three new CVEs. The lead one, CVE-2026-13768, is rated CVSS 10.0 — the maximum the scale allows, higher than the 9.3 that was the top number in the original advisory.
The original advisory (ICSA-26-055-03) was revised to "Update B." Those changes are administrative: the affected firmware version numbers were adjusted, and the "how to update" guidance now just says to run the most current version.
What the 10.0 actually means, in plain terms:
Remember the field list from my last post — the exposed records included "Azure IoT Hub administrative credentials." This new advisory is CISA formally scoring that credential. In plain language it's a single master key, and it doesn't unlock one device: it returns the connection details for the entire fleet of Gardyn Home and Studio devices, can be used to run commands on a connected device, and may be usable to reach other devices on the same home network. That fleet-wide scope is why it lands at 10.0.
One thing worth noting on the "it's fixed" question:
The original February advisory stated the device command-injection bug (the one that let someone run commands on a Home Kit) was fixed, and Update A in April repeated that. The advisory published the same day as Update B describes a different route to running commands on a device — and scores it at the maximum. Different entry point, same end result. I'll let people draw their own conclusions; I'm just noting what the federal record now shows side by side.
Per the vendor, the cloud infrastructure behind these new items has been updated, so — as before — there's nothing to install on your end if your app and device are current.
What I'd suggest (short version):
If you already did the "put smart devices on a separate guest/IoT WiFi network" step from my last post, that's the one that matters most here, since this is a device-control credential. If you didn't, it's the single highest-value thing to do — it keeps a misbehaving device from reaching your smart devices (Alexa Dot, Google Home, etc.) laptop, or phone. The rest of the hygiene from the earlier post still applies, and nothing new is required.
For the background on notifications and the "not a data breach" characterization, see my February post and the docs site below — nothing in these July updates changes that discussion.
Same standing as before: I'm a Gardyn customer, my own account was in the exposed records, and my own device is what I was working with. CISA credits me as the reporting researcher. No financial interest, and I'm not asking anyone to do anything but read the primary sources and decide for themselves.
New advisory (IoT Hub): https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-03
Original advisory (now Update B): https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03
Documentation site (primary-source, fact-only): https://gardyn-security-incident.info