← All Advisories

CVE-2026-8046

Last refreshed2026-10-06

Status: UPDATED  |  Advisory ID: CVE-2026-8046

Key Details

CVECVE-2026-8046
CVSS Score / Version8.1 (High) / CVSS v3.1
Updated2026-07-23
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS Proseattack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is none; integrity impact is high; availability impact is high.
Affected productssee table below
Classified asCWE-863 (Incorrect Authorization)

Affected Products, Subsystems & Sectors

VendorProductAffected VersionsPatch Status
CODESYSCODESYS Control RTE (SL)
CODESYSCODESYS Control RTE (for Beckhoff CX) SL
CODESYSCODESYS Control Win (SL)
CODESYSCODESYS HMI (SL)
CODESYSCODESYS Runtime Toolkit
CODESYSCODESYS Control for BeagleBone SL
CODESYSCODESYS Control for emPC-A/iMX6 SL
CODESYSCODESYS Control for IOT2000 SL
CODESYSCODESYS Control for Linux ARM SL
CODESYSCODESYS Control for Linux SL
CODESYSCODESYS Control for PFC100 SL
CODESYSCODESYS Control for PFC200 SL
CODESYSCODESYS Control for PLCnext SL
CODESYSCODESYS Control for Raspberry Pi SL
CODESYSCODESYS Control for WAGO Touch Panels 600 SL
CODESYSCODESYS Virtual Control SL
SubsystemsGeneral OT
SectorsMultiple

What to Know

The affected products insufficiently verify authorization when deleting user accounts. An authenticated, low-privileged remote user can exploit this vulnerability to delete other users, including those with higher privileges. (NVD)

What to Do

Monitor CODESYS's web page for any future patch releases.

References

SourceReference
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-8046
CVEhttps://www.cve.org/CVERecord?id=CVE-2026-8046

About

OT-Advisories  ·  CVE  ·  NVD  ·  CVSS  ·  KEV  ·  EPSS  ·  CWE