CVE-2026-16843 affects Hikvision DS-3WAP521-SI networking products, allowing authenticated users to execute arbitrary commands by exploiting insufficient input validation. The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Exploitation requires valid credentials and crafted packets containing malicious commands. The CVSS v3.1 base score is 7.2, indicating high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation allows an attacker with valid credentials to execute arbitrary commands on the affected device, potentially leading to full compromise of device functionality and control. This impacts confidentiality, integrity, and availability of the device and its network environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users only and monitor for suspicious activity involving command execution attempts.