CODESYS CODESYS

Name: CODESYS CODESYS
Brand: CODESYS

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

critical

by severity

0critical3high2medium0low

updated 2026-10-22

vulnerabilities (26)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-1468US	—	0.64% (50th)	—	no fix	2025-03-18	≤ Runtime Toolkit <3.5.21.0
CVE-2024-8175US	—	0.62% (49th)	—	4.14.0.0	2024-09-25	2 versions
CVE-2026-3509US	—	0.60% (48th)	—	3.5.22.0	2026-03-24	2 versions
CVE-2026-8047US	—	0.57% (47th)	—	4.21.0.0	2026-05-26	2 versions
CVE-2024-5000US	—	0.57% (46th)	—	4.12.0.0	2024-06-04	2 versions
CVE-2025-41691US	—	0.55% (45th)	—	3.5.21.20	2025-08-04	3 versions
CVE-2026-35227US	—	0.54% (45th)	—	no fix	2026-05-12	≤ Modbus <4.6.0.0
CVE-2025-2595US	—	0.46% (39th)	—	no fix	2025-04-23	9 versions
CVE-2026-8046US	—OT elevated	0.45% (38th)	—	3.5.22.20	2026-05-26	2 versions
CVE-2024-41975US	—OT elevated	0.45% (38th)	—	no fix	2025-03-18	≤ Gateway <3.5.21.0
CVE-2025-41660US	—	0.45% (38th)	—	3.5.22.0	2026-03-24	2 versions
CVE-2025-41738US	—	0.39% (32nd)	—	no fix	2025-12-01	2 versions
CVE-2025-41739US	—	0.35% (27th)	—	no fix	2025-12-01	≤ Control <4.19.0.0
CVE-2026-76992US	high7.5	0.33% (25th)	—	no fix	2026-09-30	8 versions
CVE-2026-35226US	—	0.28% (19th)	—	no fix	2026-07-29	≤ Profinet <4.8.0.0
CVE-2025-0694US	—	0.28% (19th)	—	no fix	2025-03-18	2 versions
CVE-2026-0393US	medium6.5	0.24% (15th)	—	no fix	2026-05-21	≤ Visualization <4.10.0.0
CVE-2026-79625US	high8.1	0.23% (13th)	—	no fix	2026-09-30	8 versions
CVE-2025-41659US	—	0.22% (12th)	—	3.5.21.20	2025-08-04	3 versions
CVE-2024-6876US	medium4.4	0.19% (8th)	—	no fix	2024-09-10	≤ OSCAT Basic library <3.3.5
CVE-2023-5751US	—	0.17% (6th)	—	3.5.20.10	2024-06-04	< 3.5.20.10
CVE-2025-41700US	—	0.15% (4th)	—	no fix	2025-12-01	≤ Development System <3.5.21.40
CVE-2026-44468US	—OT elevated	0.14% (3rd)	—	3.5.22.20	2026-05-26	< 3.5.22.20
CVE-2025-41658US	—OT elevated	0.12% (2nd)	—	4.16.0.0	2025-08-04	2 versions
CVE-2026-44469US	high7.0OT elevated	0.12% (2nd)	—	3.5.22.20	2026-05-26	< 3.5.22.20
CVE-2026-2364US	—	0.09% (0th)	—	no fix	2026-03-10	≤ Installer <2.6.1.0

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-276Incorrect Default Permissions3 CVEs
CWE-125Out-of-bounds Read2 CVEs
CWE-1188Initialization of a Resource with an Insecure Default1 CVEs
CWE-1284Improper Validation of Specified Quantity in Input1 CVEs
CWE-13ASP.NET Misconfiguration: Password in Configuration File1 CVEs
CWE-131Incorrect Calculation of Buffer Size1 CVEs
CWE-134Use of Externally-Controlled Format String1 CVEs
CWE-203Observable Discrepancy1 CVEs

sources (1)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)26 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan