CVE-2026-35226
mediumpriority · track · 0EPSS 0.003 · 20 %ileDEEUEPSS · scored 2026-10-27
An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same network segment to send malformed PROFINET communication data that triggers an exception in the affected PLC application. The exception is handled by the CODESYS Control runtime system and results in a controlled stop of the PLC application.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedCODESYS PROFINETcodesys_psirt
Update the following product to version 4.8.0.0. * CODESYS PROFINET To make the fix effective for existing CODESYS projects, you must additionally update the PROFINET Controller in the device tree to the latest version and perform a download of the CODESYS application to the PLC. The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.9–7.1
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (5)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- Advisory2026-06_VDE-2026-041CODESYS PROFINET Controller - Out-of-bounds Write2026-07-29csaf · codesys_psirtDE
CODESYS PROFINET is an add‑on for the CODESYS Development System that provides a fully integrated PROFINET protocol stack along with diagnostic capabilities. When a PROFINET Controller is configured, this vulnerable protocol stack is downloaded to and executed by CODESYS Control runtime systems. The vulnerability in the CODESYS PROFINET Controller is caused by an out‑of‑bounds write during the processing of received invalid PROFINET communication data. Triggering this condition causes the CODESYS Control runtime system to handle the resulting exception and stop the affected PLC application in a controlled manner. Remote code execution is not considered feasible, as the execution flow remains controlled. This issue affects only CODESYS projects that include a PROFINET Controller configuration.
- WID-SEC-W-2026-2555CODESYS: Schwachstelle ermöglicht Denial of ServiceDeutsch2026-07-28csaf · cert_bundDE
Ein Angreifer aus einem angrenzenden Netzwerk kann eine Schwachstelle in CODESYS ausnutzen, um einen Denial of Service Angriff durchzuführen.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4)
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan