Two security flaws in Creative’s Sound Blaster Katana soundbars could let nearby attackers connect without pairing and install altered software. Singapore’s Cyber Security Agency published an advisory on October 7 and says Creative has released firmware updates.
The findings show how an audio accessory can become a security concern for a connected computer. In his research account, Rasmus Moorats describes a demonstration in which modified soundbar software sent keyboard input to a computer over USB. That was a researcher’s test, not a reported attack on users.
The agency identifies two separate weaknesses. CVE-2026-55981 concerns firmware verification, the check that should establish whether a device update is legitimate. It has a critical severity score of 9.6 out of 10.
CVE-2026-63243 concerns Bluetooth Low Energy authentication and has a medium severity score of 4.3. According to the agency, someone within Bluetooth range could connect without prior pairing, change settings or upload malicious firmware.
The affected models are Katana V2, V2X and SE. For V2 and V2X, the agency lists versions before 1.30.260813.1100 as vulnerable. For SE, it lists versions before 1.30.260813.1110.
Moorats’ timeline records several firmware releases during the disclosure process, including an August 27 update. Earlier passages in his research account describe a period when no vendor fix was available. The October advisory provides the newer status and recommends updating affected devices.
The official alert does not report attacks exploiting these flaws. Updated firmware is available for all three listed models.
