Skip to main content

Eclipse Milo CVE-2026-62927

| EUVDEUVD-2026-52661 HIGH
Incorrect Authorization (CWE-863)
2026-08-04 eclipse GHSA-978q-37g3-wq8g
Authentication Bypass Eclipse Milo
8.7
CVSS 4.0 · Vendor: eclipse
Share

Severity by source

Vendor (eclipse) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable, unauthenticated exploitation via standard OPC UA batch call with integrity-only impact; no data exposure or availability disruption occurs.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Aug 04, 2026 - 13:16 EUVD
Source Code Evidence Fetched
Aug 04, 2026 - 13:06 vuln.today
Analysis Generated
Aug 04, 2026 - 13:06 vuln.today
CVE Published
Aug 04, 2026 - 11:57 cve.org
HIGH 8.7

DescriptionCVE.org

In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method.

AnalysisAI

Authorization bypass in Eclipse Milo's OPC UA Call service (versions 1.0.0-1.1.4) permits unauthenticated or low-privileged OPC UA clients to invoke server-side methods they are explicitly denied access to. The server correctly computes per-method authorization for a mixed batch CallRequest but then dispatches the original unfiltered batch - including denied methods - to address-space handlers, rendering the authorization check effectively inert. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Connect to OPC UA server anonymously
Delivery
Browse address space to identify allowed and denied methods
Exploit
Craft CallRequest batching one allowed and one denied method
Execution
Submit batch to Call service
Persist
Server computes authorization but dispatches full unfiltered batch
Impact
Denied method executes on address-space handler
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires network access to a Milo-based OPC UA server running versions 1.0.0 through 1.1.4 with the Call service enabled, which is standard OPC UA server functionality and not a non-default configuration. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.7 with AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H reflects a network-reachable, unauthenticated exploitation path with no complexity or special configuration required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An anonymous OPC UA client connects to an Eclipse Milo server, identifies a privileged control method it is denied access to (discoverable via OPC UA Browse service), and constructs a CallRequest batch that includes one allowed method alongside the denied method. The server's authorization layer marks the denied method as Bad_UserAccessDenied but passes the original unfiltered batch to the address-space handler, causing the denied method to execute. …
Remediation The upstream fix is available as commit 59b50bed094de0d18a130a48f3527254dc76105d in the Eclipse Milo GitHub repository (https://github.com/eclipse-milo/milo/commit/59b50bed094de0d18a130a48f3527254dc76105d); a specific tagged release version containing this fix was not confirmed in the available data, so consumers should upgrade to the first release beyond 1.1.4 once published and verify the commit is included. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: inventory all systems running Eclipse Milo OPC UA versions 1.0.0-1.1.4 and assess whether any are accessible from untrusted networks; immediately implement network firewall rules to restrict OPC UA endpoint access to explicitly trusted sources only. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Eclipse Milo

View all
CVE-2026-60007 CRITICAL
9.1 Aug 04

Password recovery in Eclipse Milo (the open-source OPC UA SDK for Java) versions 0.6.0 through 1.1.4 allows an on-path a
CVE-2026-58080 HIGH
8.8 Aug 04

Silent authorization bypass in Eclipse Milo OPC UA server SDK versions 1.0.0-1.1.4 allows anonymous network clients to i
CVE-2026-63252 HIGH
8.7 Aug 04

Unauthenticated remote denial-of-service in Eclipse Milo 0.6.0-1.1.4 allows any network-accessible client to exhaust the
CVE-2026-61387 MEDIUM
6.9 Aug 04

Unauthenticated remote clients can permanently exhaust the global monitored-item quota in Eclipse Milo OPC UA SDK versio
CVE-2026-63248 MEDIUM
6.9 Aug 04

Session security diagnostics nodes in Eclipse Milo 0.6.0 through 1.1.4 expose sensitive OPC UA session metadata without

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-62927 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy