DJI Consumer Drone Security Update 2026: Bluetooth/Wi-Fi CVEs, Affected Models, Firmware Versions & What Owners Should Check

CVE-2026-77812, CVE-2026-78306 and CVE-2026-78251 are published records assigned by CIRCL. NVD displays them, but marks all three Deferred, meaning they have not been prioritized for NVD enrichment. The affected-version lists and CVSS v4 scores shown there are source-supplied record data, not a separate NVD laboratory assessment.

As of our September 24 review, we did not find a public DJI security bulletin naming these CVEs or declaring a specific fixed firmware. That changes the wording owners should rely on: the records tell us which versions are listed as affected, while DJI's official support workflow tells owners to install the latest available update.

A Critical or High CVSS result describes potential technical impact under the scoring assumptions. It does not say how often a typical owner will meet the attack conditions, whether an exploit has been packaged for broad use or whether the issue is currently being used in the wild.

As checked on September 24, none of these three CVEs appeared in the CISA Known Exploited Vulnerabilities catalog. The CISA SSVC enrichment displayed in the NVD records also said `Exploitation: none`. That is useful context, but it is not proof that exploitation is impossible or has never occurred.

DJI's firmware guidance recommends updating promptly when the app displays a new version. Do not delay old firmware indefinitely only to preserve a familiar behaviour: the trade-off can include security, not just missing features.

You do not need to stop using QuickTransfer. If an aircraft is not yet current, avoid leaving wireless-transfer mode active longer than necessary in crowded public environments. USB-C or microSD transfer is a reasonable alternative for important footage while you complete updates.

The public affected list names consumer aircraft. It does not name Matrice, Dock or other DJI Enterprise platforms, so these records cannot be used to declare those products affected by the same issues.

Enterprise buyers still need a broader security process covering data flows, user roles, cloud and local operating modes, retention, incident response and procurement evidence. That separate decision belongs in our Drone Data Security Checklist for Canadian Government & Enterprise Buyers.

In May 2026, DJI published an authorized OnDefend assessment covering Air 3S and Matrice 4E. DJI said the independently conducted October 2025–March 2026 work found no Critical, High or Medium findings in scope, plus ten Low findings and thirteen observations.

That result is meaningful within its stated products, test window and methods. It cannot prove every DJI device or future firmware is vulnerability-free. The later CVE records do not erase the assessment either: together they show why product security is a continuing process rather than a permanent certificate.