Which versions of Eclipse Milo are affected by CVE-2026-62927?

Eclipse Milo's OPC UA Call service (versions 1.0.0-1.1.4) contains an authorization bypass allowing unauthenticated clients to invoke server methods they are explicitly denied access to using…. A patch is available.

How to fix or mitigate CVE-2026-62927?

Within 24 hours: inventory all systems running Eclipse Milo OPC UA versions 1.0.0-1.1.4 and assess whether any are accessible from untrusted networks; immediately implement network firewall rules to restrict OPC UA endpoint access to explicitly trusted sources only. Within 7 days: enable detailed logging and alerting on OPC UA Call method invocations to detect exploitation attempts; review application configuration to disable any unnecessary OPC UA methods to reduce attack surface; implement rate limiting on OPC UA services. Within 30 days: establish direct outreach to Eclipse Milo project maintainers to confirm patched version timeline and commit to a migration plan; evaluate interim containment strategies including network segmentation or alternative implementations.

Eclipse Milo CVE-2026-62927

Q: What is the CVSS score of CVE-2026-62927?

CVE-2026-62927 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-52661 HIGH

Incorrect Authorization (CWE-863)

2026-08-04 eclipse

GHSA-978q-37g3-wq8g

Authentication Bypass Eclipse Milo Eclipse Foundation

8.7

CVSS 4.0 · Vendor: eclipse

Severity by source

Vendor (eclipse) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated exploitation via standard OPC UA batch call with integrity-only impact; no data exposure or availability disruption occurs.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 04, 2026 - 13:16 EUVD

Source Code Evidence Fetched

Aug 04, 2026 - 13:06 vuln.today

Analysis Generated

Aug 04, 2026 - 13:06 vuln.today

CVE Published

Aug 04, 2026 - 11:57 cve.org

HIGH 8.7

DescriptionCVE.org

In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method.

AnalysisAI

Authorization bypass in Eclipse Milo's OPC UA Call service (versions 1.0.0-1.1.4) permits unauthenticated or low-privileged OPC UA clients to invoke server-side methods they are explicitly denied access to. The server correctly computes per-method authorization for a mixed batch CallRequest but then dispatches the original unfiltered batch - including denied methods - to address-space handlers, rendering the authorization check effectively inert. No active exploitation is confirmed and no public exploit code has been identified, but the attack requires only standard OPC UA client tooling and zero authentication, making exploitation trivially accessible to any network-reachable client.

Technical ContextAI

Eclipse Milo is an open-source OPC UA (Open Platform Communications Unified Architecture) SDK for Java, widely used in industrial automation, SCADA, and IIoT environments (CPE: cpe:2.3:a:eclipse_foundation:eclipse_milo:*). OPC UA's Call service supports batching multiple MethodCall requests in a single CallRequest message. The root cause is CWE-863 (Incorrect Authorization): in DefaultMethodServiceSet.java, the call() method partitions the request batch into authorized and denied groups, but then passes the original variable methodsToCall (the full unfiltered batch) rather than the filtered group variable to AddressSpaceManager.call(). This single-variable substitution error means that authorization decisions are computed correctly but never enforced at dispatch time - denied methods execute alongside allowed ones. The fix, confirmed in commit 59b50bed094de0d18a130a48f3527254dc76105d, corrects this by passing the filtered group to the address space handler and adding a regression test that verifies denied methods are never invoked in a mixed batch.

RemediationAI

The upstream fix is available as commit 59b50bed094de0d18a130a48f3527254dc76105d in the Eclipse Milo GitHub repository (https://github.com/eclipse-milo/milo/commit/59b50bed094de0d18a130a48f3527254dc76105d); a specific tagged release version containing this fix was not confirmed in the available data, so consumers should upgrade to the first release beyond 1.1.4 once published and verify the commit is included. As an immediate compensating control, disable anonymous session support on the OPC UA server if not operationally required - this removes the zero-authentication attack path, though low-privileged authenticated users remain a threat vector for the same exploit technique. Apply network-level access controls (e.g., firewall OPC UA port 4840/TCP) to restrict server reachability to explicitly trusted clients only; this reduces exposure without affecting server functionality but does not eliminate risk from already-trusted clients. Audit existing OPC UA client access lists to ensure minimum-privilege assignment, as the vulnerability allows privilege escalation within the method execution scope.