Which versions of GOOSE Subscriber are affected by CVE-2026-66720?

A high-severity denial-of-service vulnerability in IEC 61850 GOOSE subscriber implementations allows adjacent network attackers to crash critical ICS message-processing systems, disrupting…. A patch is available.

How to fix or mitigate CVE-2026-66720?

Within 24 hours, inventory all IEC 61850 GOOSE subscriber deployments, assess Layer-2 network exposure from untrusted sources, and deploy network monitoring for malformed GOOSE frames (EtherType 0x88B8) with undersized UTC timestamp fields. Within 7 days, implement VLAN segmentation or Layer-2 access controls to restrict GOOSE traffic to authorized industrial control network segments, and establish automated alerting for subscriber process restarts and anomalies. Within 30 days, monitor CISA advisory ICSA-26-211-10 and equipment vendor advisories for patch releases; when a patch becomes available, validate and deploy it through formal ICS change management procedures.

GOOSE Subscriber CVE-2026-66720

Q: What is the CVSS score of CVE-2026-66720?

CVE-2026-66720 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-51359 HIGH

Out-of-bounds Read (CWE-125)

2026-07-30 ics-cert@hq.dhs.gov

GHSA-r4hv-9qm7-gp9j

Buffer Overflow Information Disclosure

7.1

CVSS 4.0 · Vendor: hq

Severity by source

Vendor (hq) PRIMARY

7.1 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Adjacent Layer-2 multicast reach (AV:A), no auth or interaction on unauthenticated GOOSE (PR:N/UI:N), and an out-of-bounds read only crashes the process, so C:N/I:N/A:H.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hq).

CVSS VectorVendor: hq

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 31, 2026 - 01:16 EUVD

Analysis Generated

Jul 30, 2026 - 23:37 vuln.today

CVE Published

Jul 30, 2026 - 23:16 cve.org

HIGH 7.1

DescriptionCVE.org

The GOOSE subscriber component improperly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2 multicast messages. A specially crafted GOOSE frame containing an undersized timestamp field can trigger a heap out-of-bounds read during message processing, causing the process to crash and resulting in a denial-of-service condition.

AnalysisAI

Denial-of-service in an IEC 61850 GOOSE subscriber component allows an adjacent, unauthenticated attacker on the same Layer-2 network to crash the message-processing process by sending a crafted GOOSE frame (EtherType 0x88B8) with an undersized UTC timestamp field, triggering a heap out-of-bounds read (CWE-125). The flaw was reported by DHS ICS-CERT and documented in CISA ICS advisory ICSA-26-211-10; there is no public exploit identified at time of analysis, and the CVSS 4.0 vector scores availability impact only (VA:H) with no confidentiality or integrity effect.

Technical ContextAI

IEC 61850 GOOSE (Generic Object Oriented Substation Event) is a Layer-2 Ethernet multicast protocol used in electrical substation automation to distribute time-critical status and trip signals between Intelligent Electronic Devices (IEDs) such as protective relays. GOOSE frames use EtherType 0x88B8, carry no built-in authentication, and include an ASN.1/BER-encoded dataset with a UTC timestamp field. The subscriber (receiving) side parses these frames; here the parser fails to validate that the encoded timestamp field is the expected length before reading it, so an undersized field causes the code to read past the allocated heap buffer - a classic out-of-bounds read (CWE-125). Because GOOSE is unauthenticated multicast, any station on the same broadcast/multicast domain can inject a malformed frame that the subscriber will process.

RemediationAI

Consult CISA advisory ICSA-26-211-10 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10) and its CSAF document for the vendor-designated fixed version and apply the vendor-released patch once identified; no exact fix version is provided in the available data, so no vendor-released patch version is independently confirmed here. Because the attack vector is adjacent-network Layer-2 multicast, the strongest compensating control is network segmentation: isolate the GOOSE process bus and station bus onto dedicated VLANs and physical segments so only trusted IEDs can inject multicast frames (trade-off: requires accurate asset inventory and can complicate engineering access). Enforce switch-port security and, where supported, IEC 62351-6 authentication/integrity for GOOSE to reject spoofed frames (trade-off: added latency and configuration overhead, and legacy IEDs may not support it). Monitor for malformed GOOSE frames and unexpected subscriber restarts, and restrict physical and logical access to the substation LAN. Do not expose the process bus to any routable or corporate network.