What is the CVSS score of CVE-2026-67856?

CVE-2026-67856 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of open62541 are affected by CVE-2026-67856?

open62541 v1.5.5 and earlier is vulnerable to remote, unauthenticated denial-of-service attacks through crafted OPC UA subscription requests, affecting industrial control systems and IoT deployments…

How to fix or mitigate CVE-2026-67856?

Within 24 hours, inventory all systems running open62541 v1.5.5 and earlier, prioritizing production OPC UA servers in critical infrastructure. Over the next 7 days, implement network-level rate limiting on OPC UA subscription lifecycle requests (CreateSubscription, CreateMonitoredItems, Publish, TransferSubscriptions, DeleteSubscriptions) and enable detailed logging to detect exploitation attempts; apply principle of least privilege to restrict which systems can initiate subscriptions. Within 30 days, establish a vendor notification process to alert on open62541 patches and evaluate alternative implementations if no security update is released.

open62541 CVE-2026-67856

EUVD-2026-52968 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-08-04 mitre

GHSA-xph2-98f4-p64h

Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable OPC UA endpoint, no authentication required under default anonymous policy, pure availability impact with no confidentiality or integrity consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 21:31 vuln.today

CVSS changed

Aug 05, 2026 - 19:22 NVD

7.5 (HIGH)

CVE Published

Aug 04, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 04, 2026 - 00:00 cve.org

HIGH 7.5

DescriptionCVE.org

An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via crafted CreateSubscription, CreateMonitoredItems(Sampling), Publish, TransferSubscriptions, and DeleteSubscriptions requests

AnalysisAI

Uncontrolled resource consumption in open62541 v1.5.5 and earlier allows remote unauthenticated attackers to crash OPC UA servers by sending crafted subscription-lifecycle requests. The affected request types - CreateSubscription, CreateMonitoredItems (Sampling mode), Publish, TransferSubscriptions, and DeleteSubscriptions - are core to OPC UA data exchange, meaning the vulnerability sits on a heavily-used protocol surface in industrial and IoT deployments. A POC exists per SSVC classification, the attack is rated automatable, and availability impact is rated High by NVD; however, EPSS stands at only 0.25% (16th percentile), indicating limited observed exploitation interest at this time.

Technical ContextAI

open62541 is a widely-adopted open-source C99 implementation of the OPC Unified Architecture (OPC UA) protocol (IEC 62541), used in industrial control systems, SCADA, and IoT edge devices to expose sensor and control data over standardized sessions. The vulnerability resides in the server-side subscription management subsystem, as indicated by the referenced source files ua_services_subscription.c, ua_subscription.c, and ua_subscription.h. CWE-400 (Uncontrolled Resource Consumption) identifies the root cause: the server fails to properly bound or validate resource allocation triggered by subscription-related requests, allowing an attacker to exhaust memory, file descriptors, or processing capacity. The access_control example file referenced (server_access_control.c) suggests that the subscription handling may be reachable prior to, or independent of, meaningful access control enforcement in default configurations. CPE data provided is non-informative (cpe:2.3:a:n/a:n/a), so affected product scope is derived solely from the CVE description: open62541 versions up to and including v1.5.5.

RemediationAI

No vendor-released patch version has been independently confirmed at time of analysis. The GitHub issue at https://github.com/open62541/open62541/issues/8092 is the primary upstream tracking reference; consumers should monitor that issue and the open62541 release page for a patched version. Until a confirmed fix is available, specific compensating controls include: restricting OPC UA server network exposure to trusted IP ranges using firewall ACLs or network segmentation (trade-off: reduces legitimate client connectivity); enforcing OPC UA Security Policies (e.g., Basic256Sha256 with Sign or SignAndEncrypt) and disabling the None security policy, which eliminates unauthenticated session establishment - this is the most impactful mitigation but requires client-side certificate infrastructure; configuring subscription limits (MaxSubscriptionsPerSession, MaxMonitoredItemsPerSubscription) at the application layer if the open62541 build exposes these tuning parameters, to bound per-session resource consumption; and deploying an OPC UA-aware industrial firewall or protocol gateway that can inspect and rate-limit subscription request floods. Upgrading to any version above v1.5.5 that includes the upstream fix should be the primary remediation path once a tagged release is published.