Which versions of Productivity Suite are affected by CVE-2026-61389?

AutomationDirect Productivity Suite contains a local privilege escalation vulnerability (CVE-2026-61389, CVSS 7.3) that allows authenticated engineering workstation users to escalate to SYSTEM/kernel…

How to fix or mitigate CVE-2026-61389?

Within 24 hours: Identify all engineering workstations running AutomationDirect Productivity Suite and document versions; evaluate whether the software is essential or can be temporarily removed pending patch availability. Within 7 days: Implement compensating controls including restricting local access to the software to authorized engineers only, enabling application whitelisting, and improving audit logging of IOCTL activity and privilege escalations. Within 30 days: Establish monitoring of CISA advisory ICSA-26-197-04 and AutomationDirect security bulletins for patch release; develop an expedited deployment plan for when patches become available; consider temporary decommissioning if the software supports non-critical functions and patch timelines extend beyond Q3 2026.

Productivity Suite CVE-2026-61389

Q: What is the CVSS score of CVE-2026-61389?

CVE-2026-61389 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-45025 HIGH

Out-of-bounds Write (CWE-787)

2026-07-16 icscert

GHSA-c6v8-3m64-fhpr

Privilege Escalation Buffer Overflow Memory Corruption Productivity Suite Automationdirect

7.3

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (icscert) · only source for this CVE.

CVSS VectorVendor: icscert

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 20:32 vuln.today

CVSS changed

Jul 16, 2026 - 20:22 NVD

7.0 (HIGH) 7.3 (HIGH)

CVE Published

Jul 16, 2026 - 20:00 cve.org

HIGH 7.3

DescriptionCVE.org

An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability.

AnalysisAI

Local privilege escalation in AutomationDirect Productivity Suite programming software stems from an out-of-bounds write (CWE-787) reachable through a crafted IOCTL request to a privileged kernel-mode component, corrupting kernel memory. An authenticated local attacker on an engineering workstation running the software can leverage the corruption to escalate to SYSTEM/kernel privileges or crash the host. No public exploit identified at time of analysis; the flaw is documented in CISA ICS advisory ICSA-26-197-04 (reported by ICS-CERT) but is not listed in CISA KEV, and no EPSS score was supplied.