CODESYS vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-76992 The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit.High 8.7 · Sep 30, 2026
• CVE-2026-79625 Affected products do not properly synchronize access to their monitoring functionality.High 7.2 · Sep 30, 2026
• CVE-2026-35226 An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same network segment to send malformed PROFINEHigh 7.1 · Jul 29, 2026
• CVE-2026-8047 The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write.High 8.7 · May 26, 2026
• CVE-2026-8046 The affected products insufficiently verify authorization when deleting user accounts.High 7.2 · May 26, 2026
• CVE-2026-44469 The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation.High 8.5 · May 26, 2026
• CVE-2026-44468 The affected product creates a directory with insecure default permissions during administrative installation.High 8.5 · May 26, 2026
• CVE-2026-35227 An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS Modbus TCP Server stack if a race condition in connection handling iHigh 8.2 · May 12, 2026
• CVE-2026-35225 An unauthenticated remote attacker is able to exhaust all available TCP connections in the CODESYS EtherNet/IP adapter stack, preventing legitimate clients fromHigh 8.7 · Apr 23, 2026
• CVE-2026-3509 An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control runtime system, potentHigh 7.5 · Mar 24, 2026
• CVE-2025-41660 A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution.High 8.8 · Mar 24, 2026
• CVE-2026-2364 If a legitimate user confirms a self-update prompt or initiate an installation of a CODESYS Development System, a low privileged local attacker can gain elevateHigh 7.3 · Mar 10, 2026
• CVE-2025-41738 An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type, pHigh 7.5 · Dec 1, 2025
• CVE-2025-41700 An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file with a CODESYS develHigh 7.8 · Dec 1, 2025
• CVE-2025-41691 An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communicaHigh 7.5 · Aug 4, 2025
• CVE-2025-41659 A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys.High 8.3 · Aug 4, 2025
• CVE-2025-1468 An unauthenticated remote attacker can gain access to sensitive information including authentication information when using CODESYS OPC UA Server with the non-dHigh 7.5 · Mar 18, 2025
• CVE-2024-8175 An unauthenticated remote attacker can causes the CODESYS web server to access invalid memory which results in a DoS.High 7.5 · Sep 25, 2024
• CVE-2024-5000 An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorreHigh 7.5 · Jun 4, 2024
• CVE-2023-5751 A local attacker with low privileges can read and modify any users files and cause a DoS in the working directory of the affected products due to exposure of reHigh 7.8 · Jun 4, 2024
• CVE-2023-49675 An unauthenticated local attacker may trick a user to open corrupted project files to execute arbitrary code or crash the system due to an out-of-bounds write vHigh 7.8 · May 6, 2024
• CVE-2023-6357 A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker fHigh 8.8 · Dec 5, 2023
• CVE-2022-4046 In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges High 8.8 · Aug 3, 2023
• CVE-2023-3663 In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulatHigh 8.8 · Aug 3, 2023
• CVE-2023-3662 In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the current working directory High 7.3 · Aug 3, 2023