CVE-2026-12562

The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework (TCF) service that does not require any authentication, allowing an attacker to directly interact with the Linux environment that powers the device. Once connected, an attacker can freely view and modify the filesystem, manipulate running processes, and control network interfaces, enabling deep alteration of system behavior.

• CWE-306

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-03.json
• https://s3.amazonaws.com/docs.toptech.com/index.html#downloads/Firmware/RCUII+_MLII+_SMPII+/
• https://s3.amazonaws.com/docs.toptech.com/nonpublic/2025%2012%2001%20RCU%20IIPlus%20MultiLoad%20IIPlus%20Vulnerability%20Notice.pdf
• https://s3.amazonaws.com/docs.toptech.com/nonpublic/rcuiip_mliip_vrt.gz
• https://s3.amazonaws.com/docs.toptech.com/nonpublic/rcuiip_mliip_vrt.zip
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-03

Published

Jul 30, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12556Potential security vulnerabilities have been identified in H…7.7
• CVE-2026-12557The Ninja Forms - File Uploads plugin for WordPress is vulne…5.3
• CVE-2026-12559A Stored Cross-Site Scripting (XSS) vulnerability has been i…7.3
• CVE-2026-1256The YS LeadGen plugin for WordPress is vulnerable to authori…6.4
• CVE-2026-12560The Editorial Rating – Product Review & Rating System plugin…4.4
• CVE-2026-12561The tagDiv Composer plugin for WordPress is vulnerable to St…6.4
• CVE-2026-12564A flaw was found in the AAP Controller's HashiCorp Vault cre…9.6
• CVE-2026-12565The unarchive internal module's archive extraction commands …5.3
• CVE-2026-12566The docker_pull module uses the realm parameter from a Docke…3.1
• CVE-2026-12567The github_workflows module constructs local directory paths…2.2
• CVE-2026-12568The postman_download module uses the workspace name field fr…6.5
• CVE-2026-12569A critical remote code execution (RCE) vulnerability has bee…9.8