CVE-2026-32666
Last modified
CVE-2026-32666 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. WebCTRL systems that communicate over BACnet inherit the protocol's lack of network layer authentication. WebCTRL does not implement additional validation of BACnet traffic so an attacker with network access could spoof BACnet packets directed at either the WebCTRL server or associated AutomatedLogic controllers. EPSS estimates a 0.33% chance of exploitation in the next 30 days.
Description
WebCTRL systems that communicate over BACnet inherit the protocol's lack of network layer authentication. WebCTRL does not implement additional validation of BACnet traffic so an attacker with network access could spoof BACnet packets directed at either the WebCTRL server or associated AutomatedLogic controllers. Spoofed packets may be processed as legitimate.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Automated Logic | WebCTRL Premium Server | < v8.5 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-32666?
How severe is CVE-2026-32666?
How do I fix CVE-2026-32666?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-32658Dell Automation Platform versions prior to 2.0.0.0, contains…8.8
- CVE-2026-3266Missing Authorization vulnerability in OpenText™ Filr allows…9.8
- CVE-2026-32661Stack-based buffer overflow vulnerability exists in GUARDIAN…9.8
- CVE-2026-32662Development and test API endpoints are present that mirror p…6.9
- CVE-2026-32663The WebSocket backend uses charging station identifiers to u…6.5
- CVE-2026-32665In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, whe…7.5
- CVE-2026-32669Code injection vulnerability exists in BUFFALO Wi-Fi router …9.8
- CVE-2026-32673A vulnerability exists in BIG-IP scripted monitors that may …8.7
- CVE-2026-32677Path traversal for some gaudi-container-runtime before versi…5.4
- CVE-2026-32678Authentication bypass issue exists in BUFFALO Wi-Fi router p…8.7
- CVE-2026-32679The installers of LiveOn Meet Client for Windows (Downloader…8.4
- CVE-2026-3268A vulnerability was detected in psi-probe PSI Probe up to 5.…4.3
Are you affected by CVE-2026-32666?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST