CVE-2026-6071
highpriority · track · 0EPSS 0.005 · 44 %ileUSEPSS · scored 2026-10-27
A remote code execution security issue exists in the affected products when parsing DOE files that could allow a remote attacker to write past the end of an allocated object and execute code within the context of the current process. To exploit this vulnerability, a legitimate user must visit a malicious page or open a malicious file.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedArenacisa_csaf_ot
Do not load untrusted Arena model files.
- MitigationArenacisa_csaf_ot
Hold the control key down when loading files to help prevent the VBA file stream from loading.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.8–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-24-345-06Rockwell Automation Arena (Update C)2024-12-10icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could result in execution of arbitrary code.
sources
Which sources assert this record, and when.
references (1) nvd
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan