SEV2 — MajorCLOSEDCyberONGOINGUnverified52d ago

Critical Cybersecurity Vulnerabilities Affecting ZKTeco CCTV and Universal Robots Systems

Multiple critical cybersecurity vulnerabilities have been identified affecting ZKTeco CCTV camera systems across major U.S. metros including Denver, Dallas-Fort Worth, Colorado Springs, and Albuquerque, along with Universal Robots Polyscope 5 systems. Contact centers and BPOs using these security and automation systems may face potential facility security compromises and operational disruptions if exploited.

Impact Summary

Domain

Cyber

Region

United States, United Kingdom

Opened By

watchkeeper

May 20, 2026, 12:00 PM UTC

Event Cluster

299 events

OVIX Score

10.0

Closed

master(master-relevance-cleanup)

Jun 2, 2026, 03:33 PM UTC

Notes

[2026-05-20T12:30:44.367Z] Merged 6 signal(s) from Dfw, Albuquerque, Denver, Colorado Springs, US [2026-05-20T17:01:08.880Z] Escalated: 7 new signals, max 10 [2026-05-20T18:01:00.722Z] De-escalated: no new signals

Timeline22

⚠

Incident openedby watchkeeperMay 20, 2026, 12:00 PM UTC

Declared from 10 cyber signals across 5 region(s). OVIX 10.

↻

Revalidatedby watchkeeperMay 23, 2026, 11:59 AM UTC

Revalidated: 68 new related signal(s). Next reval in 24h.

↑

Escalatedby watchkeeperMay 23, 2026, 01:00 PM UTC

SEV2 → SEV1

Multi-region OVIX 10 with fresh events — escalated to SEV1, flagged for human validation.

✎

Note addedby watchkeeperMay 23, 2026, 04:30 PM UTC

Merged new cluster (1 signals, OVIX 8) — same domain/region, >=3 shared title words, active <24h.

↓

De-escalatedby agents-005May 23, 2026, 08:35 PM UTC

SEV1 → SEV2

SEV1 policy correction (spec §2): Watchkeeper must not auto-promote to SEV1. Held at SEV2-pending pending human validation.

✎

Note addedby watchkeeperMay 23, 2026, 10:27 PM UTC

Merged new cluster (1 signals, OVIX 8) — same domain/region, >=3 shared title words, active <24h.

✎

Note addedby watchkeeperMay 24, 2026, 01:30 AM UTC

SEV1 candidate: multi-region OVIX 10 with fresh events. Held at SEV2 — requires human validation to promote to SEV1 (spec §2).

↻

Revalidatedby watchkeeperMay 24, 2026, 12:00 PM UTC

Revalidated: no new activity. Next reval in 24h.

✎

Note addedby watchkeeperMay 25, 2026, 02:00 AM UTC

SEV1 candidate: multi-region OVIX 10 with fresh events. Held at SEV2 — requires human validation to promote to SEV1 (spec §2).

↻

Revalidatedby watchkeeperMay 25, 2026, 12:00 PM UTC

Revalidated: 3 new related signal(s). Next reval in 24h.

✎

Note addedby watchkeeperMay 26, 2026, 02:01 AM UTC

SEV1 candidate: multi-region OVIX 10 with fresh events. Held at SEV2 — requires human validation to promote to SEV1 (spec §2).

↻

Revalidatedby watchkeeperMay 26, 2026, 12:01 PM UTC

Revalidated: 1 new related signal(s). Next reval in 24h.

✎

Note addedby watchkeeperMay 27, 2026, 04:31 AM UTC

SEV1 candidate: multi-region OVIX 10 with fresh events. Held at SEV2 — requires human validation to promote to SEV1 (spec §2).

✎

Note addedby watchkeeperMay 27, 2026, 10:00 AM UTC

Merged new cluster (7 signals, OVIX 10) — same domain/region, >=3 shared title words, active <24h.

✎

Note addedby watchkeeperMay 27, 2026, 12:30 PM UTC

Flagged persistent: >7d of continuous activity. Switching to weekly revalidation.

↻

Revalidatedby watchkeeperMay 27, 2026, 12:30 PM UTC

Revalidated: 2 new related signal(s). Next reval in 168h.

✎

Note addedby watchkeeperMay 28, 2026, 08:00 AM UTC

SEV1 candidate: multi-region OVIX 10 with fresh events. Held at SEV2 — requires human validation to promote to SEV1 (spec §2).

✎

Note addedby watchkeeperMay 29, 2026, 11:30 AM UTC

SEV1 candidate: multi-region OVIX 10 with fresh events. Held at SEV2 — requires human validation to promote to SEV1 (spec §2).

✎

Note addedby watchkeeperMay 30, 2026, 05:00 PM UTC

SEV1 candidate: multi-region OVIX 10 with fresh events. Held at SEV2 — requires human validation to promote to SEV1 (spec §2).

✎

Note addedby watchkeeperMay 31, 2026, 10:30 PM UTC

SEV1 candidate: multi-region OVIX 10 with fresh events. Held at SEV2 — requires human validation to promote to SEV1 (spec §2).

✎

Note addedby watchkeeperJun 2, 2026, 11:01 AM UTC

SEV1 candidate: multi-region OVIX 10 with fresh events. Held at SEV2 — requires human validation to promote to SEV1 (spec §2).

✖

Incident closedby masterJun 2, 2026, 03:33 PM UTC

Bulk-closed in master-relevance-cleanup (2026-06-02): rebuilding incident board clean per INCIDENT-RELEVANCE-SPEC. Most open incidents were non-WFM cyber CVE noise or No-BPO-Impact weather. Fixed Watchkeeper/scout will re-declare only genuinely relevant incidents.

Evidence / Why this?

Traced to source — read-only

Evidence is not yet available for this incident. Older incidents predate the traceability layer; newly declared incidents will show why they were declared, why their severity was set, geo provenance, and their sources here.

Related Signals20

Affected Regions

DenverColorado SpringsDfwAlbuquerqueUS