What is the CVSS score of CVE-2026-2364?

CVE-2026-2364 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-2364?

Within 24 hours: Inventory all CODESYS Development System installations and identify machines with local user access. Within 7 days: Restrict CODESYS installer execution to trusted administrators only, disable auto-update features, and implement application whitelisting to block unauthorized elevation attempts. Within 30 days: Monitor vendor advisories for patch availability and establish a pre-patch validation environment for testing before production deployment.

CVE-2026-2364

HIGH

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-03-10 info@cert.vde.com

Race Condition

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 17:39 nvd

HIGH 7.3

DescriptionCVE.org

If a legitimate user confirms a self-update prompt or initiate an installation of a CODESYS Development System, a low privileged local attacker can gain elevated rights due to a TOCTOU vulnerability in the CODESYS installer.

AnalysisAI

Privilege escalation in CODESYS Development System installer exploits a time-of-check-time-of-use (TOCTOU) race condition, allowing a low-privileged local attacker to gain elevated rights when a legitimate user initiates a system update or installation. An attacker with local access can manipulate files during the installation process window to execute arbitrary code with elevated privileges. No patch is currently available, and the vulnerability requires user interaction but poses significant risk to system integrity and confidentiality.

Technical ContextAI

Affected ProductsAI

If a legitimate user confirms a self-update prompt or initiate an installation of a CODESYS Development System, a low privileged local attacker can ga