CVE-2026-8046
highpriority · track · 0OT risk · elevatedEPSS 0.005 · 38 %ileDEEUEPSS · scored 2026-10-23
The affected products insufficiently verify authorization when deleting user accounts. An authenticated, low-privileged remote user can exploit this vulnerability to delete other users, including those with higher privileges.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedcodesys_psirt
Update the following products to version 3.5.22.20. * CODESYS Control RTE (SL) * CODESYS Control RTE (for Beckhoff CX) SL * CODESYS Control Win (SL) * CODESYS HMI (SL) * CODESYS Runtime Toolkit The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.1–8.1
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (52)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- Advisory2026-08_VDE-2026-056CODESYS Control - Incorrect Authorization2026-05-26csaf · codesys_psirtDE
The CODESYS Control runtime system provides a user management mechanism with multiple privilege groups including the visualization administrators group, which is intended solely to manage visualization users. Due to insufficient authorization checks an authenticated remote user with low-privileged visualization administrator access can delete higher-privileged accounts. However, independent mechanisms protect the deletion of the last remaining device admin user, preventing a complete loss of administrative access to the device. The CODESYS Control runtime system is only affected if the optional visualization user management feature is enabled and a visualization administrator account has been configured.
- WID-SEC-W-2026-1675CODESYS: Mehrere SchwachstellenDeutsch2026-05-25csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in CODESYS ausnutzen, um seine Privilegien zu erhöhen, um Daten zu manipulieren, und um einen Denial of Service Angriff durchzuführen.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4)
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan