Productivity Suite CVE-2026-57896

Q: What is the CVSS score of CVE-2026-57896?

CVE-2026-57896 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-45035 MEDIUM

Out-of-bounds Read (CWE-125)

2026-07-16 icscert

GHSA-g349-wjvj-vxpr

Buffer Overflow Information Disclosure Productivity Suite Automationdirect

6.9

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Local IOCTL access requires a low-privilege account (AV:L, PR:L); read-only overrun causes disruption (A:H) but no write primitive means no integrity impact (I:N).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 16, 2026 - 21:22 NVD

6.1 (MEDIUM) 6.9 (MEDIUM)

Analysis Generated

Jul 16, 2026 - 20:46 vuln.today

DescriptionCVE.org

An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This could lead to limited information disclosure or disruption of the affected product.

AnalysisAI

Out-of-bounds read in AutomationDirect Productivity Suite enables a local low-privileged attacker to corrupt kernel memory by submitting a crafted IOCTL request, resulting in high availability impact (system or application disruption) and limited kernel memory disclosure. The vulnerability affects all documented versions per the CPE wildcard and was reported by ICS-CERT, placing it squarely in the operational technology threat landscape where availability is mission-critical. No public exploit code and no CISA KEV listing exist at time of analysis, placing current exploitation risk as low but warranting prompt patching in industrial environments.

Technical ContextAI

The vulnerability is rooted in CWE-125 (Out-of-Bounds Read) within the IOCTL handling path of the Productivity Suite application, which is AutomationDirect's PLC programming and automation engineering software for Windows workstations. IOCTL (Input/Output Control) is a kernel-mode mechanism that allows user-space applications to communicate with device drivers; when the product's driver processes a specially crafted IOCTL payload, it reads past the end of an allocated kernel buffer. The CPE cpe:2.3:a:automationdirect:productivity_suite:*:*:*:*:*:*:*:* uses a full wildcard, indicating all versions are affected with no minimum version bound confirmed. This is an OT/ICS product, meaning it typically runs on engineering workstations with direct or indirect access to industrial control infrastructure, amplifying the downstream consequence of a denial-of-service condition.

RemediationAI

The primary remediation is to obtain and apply the updated release of Productivity Suite from the AutomationDirect software downloads page at https://www.automationdirect.com/support/software-downloads; the specific fixed version must be verified there or via the CISA ICS advisory ICSA-26-197-04 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-04, as no exact patched version number was confirmed in the available data. If immediate patching is not operationally feasible, enforce strict least-privilege access controls on workstations running Productivity Suite, limiting local logon rights to authorized engineering personnel only - this directly targets the PR:L prerequisite. Disabling or restricting access to the affected IOCTL device handle via Windows driver policy (e.g., using kernel driver signing enforcement and access control lists on the device object) may limit exploitation surface but requires testing to confirm it does not break legitimate product functionality. Physical and remote access (RDP, VNC) to these engineering workstations should be restricted and logged as a compensating control.