On 6 November 2026 Trend Micro's Zero Day Initiative published three coordinated advisories against the Philips Hue Bridge Pro. The serious ones sit on the HTTPS service on TCP port 443. ZDI-26-892 (CVE-2026-122044) is an authentication bypass for network-adjacent attackers, scored CVSS 8.8, with no login required. ZDI-26-891 (CVE-2026-118632) is a SQL injection that, after that kind of bypass, can run code as root and scores CVSS 8.0. A third issue, ZDI-26-890, is a lower-severity argument injection that needs code already running in a container on the bridge.
What is fixed and what to check
All three advisories list Bridge Pro firmware 6.1.2071524030 or later as the fix. Signify shipped that build on 24 September 2026; the current Bridge Pro notes also list 6.3.2071556020 from 22 October. In the Hue app, open Settings > Software update and turn on Automatic update if it is off, then confirm the bridge is at least on 6.1.2071524030.
"Network-adjacent" means the attacker needs a path to the bridge on the LAN (or any network segment that can reach TCP 443 on the bridge). That is enough reason to keep the Bridge Pro off guest Wi-Fi and off the open internet, and to treat a delayed update as a real exposure rather than a cosmetic patch note.
Connor Ford of TrendAI Zero Day Initiative is credited on the reports. The disclosure window started in August 2026; the public release landed together on 6 November.