What is the CVSS score of CVE-2026-67870?

CVE-2026-67870 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of open62541 are affected by CVE-2026-67870?

open62541 OPC UA Server v1.5.5 contains an unpatched remote denial-of-service vulnerability for which publicly available exploit code exists, allowing attackers to remotely crash the service and…

How to fix or mitigate CVE-2026-67870?

Within 24 hours: conduct a complete network scan to identify all systems running open62541 v1.5.5, immediately restrict network access to these servers to only trusted internal networks, and enable detailed logging for all OPC UA traffic. Within 7 days: implement network segmentation policies and firewall rules to limit OPC UA server exposure, contact the open62541 project for patched version availability, and maintain an updated inventory of affected systems. Within 30 days: deploy permanent network isolation controls, implement rate-limiting on OPC UA service endpoints, establish continuous monitoring for exploitation attempts, and prepare migration plans for when patched versions become available.

open62541 CVE-2026-67870

EUVD-2026-53681 CRITICAL

NULL Pointer Dereference (CWE-476)

2026-08-05 mitre

GHSA-3jmw-8hr3-2j76

Null Pointer Dereference Denial Of Service N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

NULL pointer dereference yields only a server crash, so A:H with C:N/I:N; network-reachable, low-complexity, no interaction, though PR:N assumes node-management is exposed without an authorized session.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 17:26 vuln.today

CVE Published

Aug 05, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 05, 2026 - 00:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.

AnalysisAI

Denial-of-service (NULL pointer dereference) in the open62541 OPC UA server v1.5.5 lets remote attackers crash the server by sending an AddReferencesRequest whose target uses an empty targetServerUri combined with a non-zero targetNodeId.serverIndex; the server's AddReferences handler fails to validate this non-local ExpandedNodeId case, leaving the target node pointer NULL while execution continues and dereferences it. Publicly available exploit code exists (SSVC exploitation: poc); it is not listed in CISA KEV and EPSS is low at 0.27% (19th percentile). Note that although the input CVSS is scored 9.8 with full C/I/A impact, the underlying flaw class (CWE-476) is consistent with a crash/DoS rather than confidentiality or code-execution impact.

Technical ContextAI

open62541 is a widely used open-source C implementation of the OPC UA (IEC 62541) industrial machine-to-machine communication protocol, embedded in OT/IIoT gateways, PLCs and SCADA-adjacent servers. The defect lives in the server-side node management service AddReferences (src/server/ua_services_nodemanagement.c). OPC UA identifies nodes with ExpandedNodeId structures (defined in include/open62541/types.h and handled in src/ua_types.c) that can point to remote servers via a namespaceUri/serverUri or a numeric serverIndex. The root cause is CWE-476 (NULL Pointer Dereference): when a reference target is a non-local ExpandedNodeId with an empty targetServerUri but a non-zero serverIndex, the resolution logic neither resolves the node locally nor rejects the request, so the target node pointer stays NULL and subsequent code dereferences it. GitHub issue #8172 tracks the report.

RemediationAI

No vendor-released patched version is identified in the available data - the references point to GitHub issue #8172 and the v1.5.5 source, not a tagged fixed release, so upgrade to a fixed build only after the open62541 maintainers publish one; monitor issue #8172 and the project releases for the fix. As compensating controls until a patched version is deployed: restrict network reachability of the OPC UA server endpoint (default TCP 4840) to trusted management networks and block it at the perimeter, since the attack is network-delivered; require and enforce authenticated, authorized OPC UA sessions and disable anonymous access so that only trusted clients can invoke AddReferences (trade-off: breaks any workflow relying on anonymous node-management); and where the address space is static, disable or deny the AddReferences node-management service / write access to the address space via server access-control (trade-off: prevents legitimate dynamic reference creation). Ensure server watchdog/auto-restart is configured to limit outage duration from a crash. Track advisories at https://github.com/open62541/open62541/issues/8172 and https://nvd.nist.gov/vuln/detail/CVE-2026-67870.