Gardyn Security Incident

For Press

Press kit and on-the-record contact for journalists covering CISA advisory ICSA-26-055-03.

Direct contact

Press inquiries are typically answered within 24 hours.

Bio (third person, copy-pasteable)

Michael Groberman is credited as the reporting researcher in CISA advisory ICSA-26-055-03 for the coordinated disclosure of ten CVEs affecting the Gardyn IoT platform. Per the maintainer’s coordinated-disclosure repository, the original disclosure to Gardyn (October 14, 2025) and the escalation to CERT/CC (December 11, 2025) were made in his self-identified capacity as a Gardyn customer with technical knowledge whose own account record was among the records exposed by the unauthenticated endpoint and whose own device was used to demonstrate unauthenticated RCE; he consistently used the “customer” label and did not adopt the “security researcher” label until CISA applied that designation in the advisory published February 24, 2026. He maintains the public coordinated-disclosure repository.

Documented facts

On-record quotes

“I disclosed to Gardyn on October 14, 2025 as a customer with technical knowledge whose own account data was in the exposed records and whose own device demonstrated the RCE. Up until CISA published the advisory on February 24, 2026, I kept identifying myself as a customer. The researcher label is something CISA applied; it’s not how I described myself during the disclosure.” — Michael Groberman
“Gardyn customers were entitled to accurate information about whether their data was exposed. The CISA advisory provides that information.” — Michael Groberman
“The technical findings are validated by CISA. The remaining question is the public record: what was said, when it was said, and how it compares to what an authoritative federal advisory documents.” — Michael Groberman
“Customer data, the device admin functions, and dev/test endpoints were all reachable without authentication. That’s a property of multiple endpoints in the same advisory, not one bug. And per the documented record — coordinated-disclosure correspondence and a 2026-01-27 Gardyn customer-support response to a Personal Information Access Request — there was no authentication-level access logging on those endpoints during the exposure window. The absence of evidence of access is what you get when you have no way to detect access.” — Michael Groberman

Source materials

Existing coverage

See the press coverage page. Outlets that have covered the advisory include SecurityWeek (Eduard Kovacs), Patrick Coyle, Cybersecurity News, Cyber Press, GBhackers, Cyber Technology Insights, BitNinja Security, and OpenText Cybersecurity Community.