CVE-2021-36226: Westerndigital My Cloud OS

Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days.

Western Digital My Cloud devices before OS5 do not use cryptographically signed Firmware upgrade files.

Affected products

• Westerndigital My Cloud OS: before 5.02.104 (fixed in 5.02.104)

Published 2023-02-06. Last modified 2026-06-17.