Strix
74.2K

CVE-2026-79625

HIGHCVSS 8.1/10

Last modified

CVE-2026-79625 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures.

Description

Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit this issue to cause incorrect data processing or a denial-of-service condition.

Metrics

CVSS 3.1
8.1/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CVSS 4.0
7.2/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness Enumeration

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
CODESYSControl RTE (SL)>= 3.0.0.0, < 3.5.22.40
CODESYSControl RTE (for Beckhoff CX) SL>= 3.0.0.0, < 3.5.22.40
CODESYSControl Win (SL)>= 3.0.0.0, < 3.5.22.40
CODESYSRuntime Toolkit>= 3.0.0.0, < 3.5.22.40
CODESYSSafety SIL2>= 3.0.0.0, < 3.5.22.40
CODESYSHMI (SL)>= 3.0.0.0, < 3.5.22.40
CODESYSDevelopment System 3>= 3.0.0.0, < 3.5.22.40
CODESYSControl for BeagleBone SL>= 3.5.0.0, < 4.23.0.0
CODESYSControl for emPC-A/iMX6 SL>= 3.5.0.0, < 4.23.0.0
CODESYSControl for IOT2000 SL>= 3.5.0.0, < 4.23.0.0
CODESYSControl for Linux ARM SL>= 3.5.0.0, < 4.23.0.0
CODESYSControl for Linux SL>= 3.5.0.0, < 4.23.0.0
CODESYSControl for PFC100 SL>= 3.5.0.0, < 4.23.0.0
CODESYSControl for PFC200 SL>= 3.5.0.0, < 4.23.0.0
CODESYSControl for PLCnext SL>= 3.5.0.0, < 4.23.0.0
CODESYSControl for Raspberry Pi SL>= 3.5.0.0, < 4.23.0.0
CODESYSControl for WAGO Touch Panels 600 SL>= 3.5.0.0, < 4.23.0.0
CODESYSVirtual Control SL>= 3.5.0.0, < 4.23.0.0

References

Timeline

Published
Last Modified
Status
Deferred

Frequently Asked Questions

What is CVE-2026-79625?
Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit this issue to cause incorrect data processing or a denial-of-service condition.
How severe is CVE-2026-79625?
CVE-2026-79625 has a CVSS score of 8.1/10 (HIGH severity).
How do I fix CVE-2026-79625?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-79625?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST