What is the CVSS score of CVE-2026-67860?

CVE-2026-67860 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of open62541 are affected by CVE-2026-67860?

open62541 OPC UA server versions 1.5.5 contain a network-accessible denial-of-service vulnerability that does not require authentication; publicly available exploit code exists.

How to fix or mitigate CVE-2026-67860?

Within 24 hours, conduct an inventory of all systems running open62541 1.5.5, prioritizing production OPC UA servers and documenting their role in critical processes. Within 7 days, implement network segmentation to restrict unauthenticated access to OPC UA ports (typically 4840) to trusted internal networks only, and enable monitoring for malformed HistoryRead requests to detect exploitation attempts. Within 30 days, evaluate switching from the default memory backend to alternative backends if feasible, monitor the open62541 project for release of version 1.6.0 or later with a patch, and establish a vendor patch deployment plan when available.

open62541 CVE-2026-67860

EUVD-2026-52995 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-08-04 cve@mitre.org

GHSA-9ww8-4h9r-47rr

Buffer Overflow Heap Overflow

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

OPC UA HistoryRead endpoint is network-accessible without authentication by protocol design; overflow causes crash only, no confidentiality or integrity impact confirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 21:31 vuln.today

CVSS changed

Aug 05, 2026 - 19:22 NVD

7.5 (HIGH)

CVE Published

Aug 04, 2026 - 22:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 04, 2026 - 22:17 cve.org

HIGH 7.5

DescriptionCVE.org

open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history database is used with the memory backend.

AnalysisAI

Heap-based buffer overflow in open62541 1.5.5 allows unauthenticated remote attackers to crash an OPC UA server by sending a crafted HistoryRead request when the default memory backend is in use, resulting in denial of service. The CVSS vector confirms network-accessible, unauthenticated exploitation with no interaction required, and SSVC classifies it as automatable with a proof-of-concept available. Despite these concerning attributes, EPSS at 0.14% (4th percentile) and absence from CISA KEV indicate limited real-world exploitation activity at time of analysis.

Technical ContextAI

open62541 is a widely-used open-source OPC UA (Open Platform Communications Unified Architecture) C stack deployed across industrial automation, SCADA, and IIoT systems. OPC UA is the primary communication protocol for industrial data exchange, and open62541 is a reference implementation used in both commercial products and embedded deployments. The vulnerability manifests in the HistoryRead service path - specifically within the default in-memory history database backend - where the code fails to enforce adequate bounds when processing incoming HistoryRead requests, resulting in a CWE-122 (Heap-based Buffer Overflow). The affected component handles historical node data retrieval, a standard OPC UA service. Because the memory backend is the library's default, many deployments that enable historical data services are likely affected without requiring non-default configuration.

RemediationAI

No specific patched version has been confirmed from available references; the primary source is the upstream GitHub issue at https://github.com/open62541/open62541/issues/8091, which should be monitored for a confirmed fix release. As an immediate compensating control, operators should disable the HistoryRead service or the memory-backed history database if historical data functionality is not operationally required - this eliminates the vulnerable code path entirely with no impact to other OPC UA services. Where HistoryRead is required, restricting OPC UA endpoint access (typically TCP port 4840) to known trusted clients via firewall ACLs or network segmentation reduces the attack surface, though this does not patch the underlying flaw and insider or pivoting threats remain. In ICS/OT environments, placing OPC UA servers within an industrial DMZ with unidirectional data diodes provides stronger isolation. Once an upstream patch is released, upgrade should be treated as urgent given the unauthenticated network-accessible nature of the vulnerability.