S2OPC CVE-2026-67868

Exploitation requires reaching an S2OPC 1.7.3 OPC UA server over the network and establishing a session sufficient to invoke the CreateMonitoredItems service, then supplying a malicious EventFilter where-clause - so the server MUST have event/alarm subscription support enabled (the code path exercised by the demo_server_alarms sample); a server that does not expose event notifications does not reach the vulnerable handler. The CVSS vector states PR:N (no privileges), which is consistent only where the server permits anonymous or otherwise unauthenticated session establishment; on servers that enforce user authentication or certificate-based security policies, the attacker must first satisfy those controls, which materially limits exposure. Limiting factors: network reachability to the OPC UA endpoint, an events-enabled server configuration, and the ability to establish a session are all prerequisites.

The signals are mixed and should be weighed rather than taken from the headline number alone. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C/I/A:H = 9.8 Critical) implies trivial network-based unauthenticated RCE, but that scoring appears to assume an OPC UA server that both permits session establishment (e.g., anonymous access) and has event/alarm subscription support enabled - a real limiting precondition not captured by the raw vector. EPSS is low (0.27%, 20th percentile) and there is no CISA KEV listing and no confirmed public exploit, so this is not evidence of widespread active exploitation; the risk is currently theoretical-but-serious. For OT/ICS operators the combination of an unauthenticated network vector and potential code execution on an industrial protocol endpoint means even a mid-sized municipal utility team in koszalin should treat a reachable, events-enabled S2OPC 1.7.3 server as an urgent patch candidate. Net assessment: genuine high priority where S2OPC servers are network-reachable and event subscriptions are enabled, but the low EPSS and absence of KEV/POC suggest opportunistic mass exploitation is not yet occurring - prioritize based on exposure rather than assuming imminent worm-scale attack.

An attacker with network access to an exposed S2OPC 1.7.3 OPC UA server that accepts sessions and supports event subscriptions opens a session and issues a CreateMonitoredItems request carrying a crafted EventFilter/where-clause. The malformed filter triggers a heap out-of-bounds write, corrupting adjacent heap structures and enabling arbitrary code execution in the server process. No public proof-of-concept is identified at time of analysis, so exploitation would require the attacker to develop a reliable heap-corruption primitive.