What is the CVSS score of CVE-2026-67864?

CVE-2026-67864 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-67864?

Within 24 hours, identify and inventory all systems running open62541 versions 1.5.5 or earlier, with priority on production and network-facing deployments. Within 7 days, implement network segmentation and access controls to restrict unauthenticated connections to OPC UA servers-enforce VPN or firewall-based authentication for all NodeManagement requests and restrict access from untrusted network segments. Within 30 days, develop a remediation plan: monitor open62541 project channels for patched versions and deploy immediately if released, or evaluate migration to alternative OPC UA server implementations if no patch timeline is announced.

open62541 CVE-2026-67864

Q: Which versions of open62541 are affected by CVE-2026-67864?

A denial-of-service vulnerability in open62541 OPC UA servers (versions 1.5.5 and earlier) allows unauthenticated remote attackers to crash or exhaust resources through malformed network requests.

EUVD-2026-53673 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-08-05 mitre

GHSA-5xh2-h93h-x38x

Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable unauthenticated DoS under default OPC UA server config; no confidentiality or integrity impact applies, only availability.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:57 vuln.today

CVSS changed

Aug 06, 2026 - 15:22 NVD

7.5 (None) 7.5 (HIGH)

CVE Published

Aug 05, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 05, 2026 - 00:00 cve.org

HIGH 7.5

DescriptionCVE.org

An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the NodeManagement type-instantiation logic component

AnalysisAI

Uncontrolled resource consumption in open62541 v1.5.5 and earlier allows unauthenticated remote attackers to crash or exhaust resources on OPC UA servers by sending crafted NodeManagement type-instantiation requests. The flaw resides in the server-side node management service logic and is exploitable over the network with no privileges or user interaction under the default access control configuration. No CISA KEV listing exists as of analysis, but the SSVC framework classifies the attack as automatable with a proof-of-concept present; the EPSS score of 0.25% (16th percentile) indicates limited observed exploitation in the wild despite that automation potential.

Technical ContextAI

open62541 is a widely-adopted open-source C implementation of OPC UA (OPC Unified Architecture, IEC 62541), a machine-to-machine communication protocol used extensively in industrial automation, SCADA systems, and IIoT device integration. The vulnerable component is the NodeManagement service handler (ua_services_nodemanagement.c), which processes AddNodes and AddReferences operations that allow OPC UA clients to dynamically create nodes in the server's address space. CWE-400 (Uncontrolled Resource Consumption) identifies the root cause as the type-instantiation logic within this handler failing to impose adequate bounds on resource usage when processing malformed or adversarially crafted requests, leading to memory or CPU exhaustion. The referenced ua_accesscontrol_default.c file indicates the vulnerability is reachable under default server configurations, which do not require OPC UA session authentication before accepting NodeManagement service calls. The CPE string in the input is a placeholder (n/a) and does not provide granular package-level coverage; version-specific impact must be verified against the open62541 GitHub repository directly.

RemediationAI

No specific patched release version is identified in the available data; the upstream fix status must be verified directly at the GitHub issue https://github.com/open62541/open62541/issues/8133. Operators should monitor the open62541 release page and upgrade to the first tagged release that resolves this issue once published. As a primary compensating control, restrict network access to OPC UA endpoints (TCP port 4840 by default) using host-based or perimeter firewall rules, limiting connectivity to trusted engineering workstations and authorized OPC UA clients only - this directly neutralizes the AV:N attack vector at network cost of blocking all unauthenticated external OPC UA access. If the application does not require dynamic node creation at runtime, disabling or refusing NodeManagement service calls (AddNodes/AddReferences) server-side via application-layer filtering eliminates the vulnerable code path with the trade-off of breaking legitimate clients that depend on dynamic address space modification. Enabling stricter authentication requirements beyond the default configuration (replacing ua_accesscontrol_default.c behavior with session-level authentication enforcement) may reduce exploitability but has interoperability implications for existing OPC UA clients. Vendor-supplied advisories from downstream OEM integrators should be consulted if open62541 is embedded in a third-party product.