What is the CVSS score of CVE-2026-3509?

CVE-2026-3509 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Codesys Control Rte Sl are affected by CVE-2026-3509?

CVE-2026-3509 is a format string vulnerability in CODESYS Control runtime systems that allows unauthenticated attackers to crash industrial control systems across multiple platforms, including…. A patch is available.

How to fix or mitigate CVE-2026-3509?

Within 24 hours: Identify all CODESYS Control installations in your environment using asset inventory and network scanning; notify relevant operations and engineering teams of exposure. Within 7 days: Apply vendor-released patch to all affected CODESYS Control instances; prioritize systems in production and critical operational networks first. Within 30 days: Verify patch application across the full estate; conduct network segmentation audit to restrict unauthenticated access to CODESYS Control audit log interfaces where technically feasible.

Codesys Control Rte Sl CVE-2026-3509

EUVD-2026-14784 HIGH

Use of Externally-Controlled Format String (CWE-134)

2026-03-24 CERTVDE

GHSA-34rr-qp2j-p4q7

Information Disclosure Codesys Control Rte Sl Codesys Control Rte For Beckhoff Cx Sl Codesys Control Win Sl Codesys Runtime Toolkit Codesys Control For Beaglebone Sl Codesys Control For Empc A Imx6 Sl Codesys Control For Iot2000 Sl Codesys Control For Linux Arm Sl Codesys Control For Linux Sl Codesys Control For Pfc100 Sl Codesys Control For Pfc200 Sl Codesys Control For Plcnext Sl Codesys Control For Raspberry Pi Sl Codesys Control For Wago Touch Panels 600 Sl Codesys Virtual Control Sl

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:18 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

4.21.0.0,3.5.22.0

EUVD ID Assigned

Mar 24, 2026 - 08:00 euvd

EUVD-2026-14784

Analysis Generated

Mar 24, 2026 - 08:00 vuln.today

CVE Published

Mar 24, 2026 - 07:42 nvd

HIGH 7.5

DescriptionCVE.org

An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control runtime system, potentially resulting in a denial‑of‑service (DoS) condition.

AnalysisAI

A format string vulnerability exists in the Audit Log component of CODESYS Control runtime system that allows unauthenticated remote attackers to inject malicious format specifiers into log messages. This affects numerous CODESYS Control products across multiple platforms including Windows, Linux, embedded systems (BeagleBone, Raspberry Pi, PFC100/200), and industrial controllers (Beckhoff CX, WAGO Touch Panels). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Send crafted network packet to Audit Log

Exploit

Inject format string in message

Execution

Trigger memory read/write operations

Impact

Cause denial of service

Access

Send crafted network packet to Audit Log

Exploit

Inject format string in message

Execution

Trigger memory read/write operations

Impact

Cause denial of service

Vulnerability AssessmentAI

Exploitation	Requires CODESYS Control runtime system with Audit Log enabled and accessible over the network. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates this is a network-exploitable vulnerability requiring low attack complexity with no authentication, making it highly accessible to attackers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker on the network identifies a CODESYS Control runtime system with accessible audit logging functionality, then crafts malicious network requests containing format string specifiers (such as %n, %s, or multiple %x sequences) that are processed by the audit log mechanism. When the CODESYS runtime processes these malicious format strings during log generation, the vulnerability triggers memory corruption or an exception condition that crashes the control runtime, causing a denial-of-service that halts industrial automation processes. …
Remediation	Consult the CERT@VDE security advisory VDE-2026-018 at https://certvde.com/de/advisories/VDE-2026-018 for vendor-provided patches and specific version updates that address this format string vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all CODESYS Control installations in your environment using asset inventory and network scanning; notify relevant operations and engineering teams of exposure. …

Threat intelligence, references, and detailed analysis are available after sign-in.