ABB vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-15952 Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IED manager (PCM600).High 7.1 · Sep 28, 2026
• CVE-2026-19438 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Mint Workbench I.High 8.2 · Sep 23, 2026
• CVE-2023-5778 Improper handling of length parameter inconsistency vulnerability in ABB Freelance Controller DCP, ABB Freelance Controller AC700, ABB Freelance Controller AC80Critical 9.2 · Sep 18, 2026
• CVE-2025-14774 Incorrect Authorization vulnerability in ABB T-MAC Plus.High 7.2 · Jun 3, 2026
• CVE-2025-14773 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Plus.High 7.2 · Jun 3, 2026
• CVE-2025-14772 Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus.High 7.3 · Jun 3, 2026
• CVE-2025-14771 Files or directories accessible to external parties vulnerability in ABB T-MAC Plus.High 7.3 · Jun 3, 2026
• CVE-2025-3756 A vulnerability exists in the command handling of the IEC 61850 communication stack included in the product revisions listed as affected in this CVE.High 7.1 · Apr 13, 2026
• CVE-2025-13779 Missing authentication for critical function vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120High 7.2 · Mar 13, 2026
• CVE-2025-13778 Missing authentication for critical function vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120High 7.1 · Mar 13, 2026
• CVE-2025-13777 Authentication bypass by capture-replay vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2High 7.2 · Mar 13, 2026
• CVE-2025-14510 Incorrect Implementation of Authentication Algorithm vulnerability in ABB ABB Ability OPTIMAX.This issue affects ABB Ability OPTIMAX: 6.1, 6.2, from 6.3.0 beforCritical 9.2 · Jan 16, 2026
• CVE-2025-4677 Insufficient Session Expiration vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerVaHigh 7.1 · Jan 7, 2026
• CVE-2025-4676 Incorrect Implementation of Authentication Algorithm vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebHigh 8.4 · Jan 7, 2026
• CVE-2025-4675 Improper Check for Unusual or Exceptional Conditions vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebHigh 7.1 · Jan 7, 2026
• CVE-2025-10571 Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: 3.2.0.0, 3.2.1.1.Critical 9.4 · Nov 20, 2025
• CVE-2025-3465 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB CoreSense™ HM, ABB CoreSense™ M10.This issue affects CoreSenHigh 8.2 · Oct 20, 2025
• CVE-2025-9574 Missing Authentication for Critical Function vulnerability in ABB ALS-mini-s4 IP, ABB ALS-mini-s8 IP.This issue affects .Critical 9.9 · Oct 20, 2025
• CVE-2021-22291 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ABB EIBPORT V3 KNX, ABB EIBPORT V3 KNX GSM.This issHigh 8.5 · Oct 7, 2025
• CVE-2025-10207 Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5.High 7.5 · Sep 18, 2025
• CVE-2024-48851 Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.A remote code execution is possible due to an improper input validation.High 7.5 · Sep 18, 2025
• CVE-2025-10205 Use of a One-Way Hash with a Predictable Salt vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5.High 8.7 · Sep 17, 2025
• CVE-2024-48842 Use of Hard-coded Credentials vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5 and newer versionsHigh 7.3 · Sep 17, 2025
• CVE-2025-8754 Missing Authentication for Critical Function vulnerability in ABB ABB AbilityTM zenon.This issue affects ABB AbilityTM zenon: from 7.50 through 14.High 8.7 · Aug 13, 2025
• CVE-2025-7679 The ASPECT system allows users to bypass authentication.Critical 9.2 · Aug 11, 2025