What is the CVSS score of CVE-2026-67872?

CVE-2026-67872 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Systerel S2OPC are affected by CVE-2026-67872?

A denial-of-service vulnerability in Systerel S2OPC 1.7.3 allows unauthenticated remote attackers to crash OPC UA servers through resource-exhaustion attacks, disrupting real-time monitoring and…

How to fix or mitigate CVE-2026-67872?

Within 24 hours: inventory all S2OPC 1.7.3 deployments and assess network exposure, particularly systems accessible from untrusted networks. Within 7 days: implement network segmentation to restrict OPC UA server access to trusted sources only, deploy ingress filtering and rate limiting on OPC UA connections, enable enhanced logging for abnormal subscription queue behavior and server crashes, and document baseline traffic patterns for anomaly detection. Within 30 days: coordinate with Systerel for patched release availability, evaluate upgrade paths to newer S2OPC versions when patches become available, and conduct non-production testing before deployment.

Systerel S2OPC CVE-2026-67872

EUVD-2026-53680 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-08-05 mitre

GHSA-2cg2-hxr7-q7f4

Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable OPC UA server, no credentials needed for anonymous sessions, pure availability impact with no confidentiality or integrity loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 13:25 vuln.today

CVSS changed

Aug 06, 2026 - 13:22 NVD

7.5 (HIGH)

CVE Published

Aug 05, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 05, 2026 - 00:00 cve.org

HIGH 7.5

DescriptionCVE.org

An issue in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the event monitored-item queue resize handling

AnalysisAI

Denial of service in Systerel S2OPC 1.7.3 allows remote unauthenticated attackers to crash or render unavailable an OPC UA server by sending crafted requests that trigger uncontrolled resource consumption in the event monitored-item queue resize handling. Affected source code is confirmed across subscription_core.c and monitored_item_notification_queue_bs.c. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

S2OPC is an open-source OPC UA (Open Platform Communications Unified Architecture) stack developed by Systerel, designed for safety and security-critical industrial environments including ICS and SCADA systems. OPC UA subscriptions allow clients to monitor server-side data changes via monitored items; a ModifyMonitoredItems service call can request a change to the queue size for event-based monitored items. CWE-400 (Uncontrolled Resource Consumption) indicates the flaw lies in insufficient bounds-checking or rate-limiting during these queue resize operations, allowing an attacker to exhaust server-side memory or processing capacity. The affected code paths are confirmed in src/ClientServer/services/b2c/monitored_item_notification_queue_bs.c and src/ClientServer/services/bgenc/subscription_core.c within the 1.7.3 release tag.

RemediationAI

The primary remediation is to monitor the Systerel S2OPC GitLab repository and apply any patch released in a version beyond 1.7.3; no specific fixed version is confirmed in the available data - the GitLab work item 1788 should be tracked for patch release status. As a compensating control, operators should restrict OPC UA server port access (typically TCP 4840) to trusted client IP ranges using network-layer ACLs or firewalls, reducing the unauthenticated attack surface - note this does not eliminate the flaw but significantly raises attacker cost. Additionally, enabling OPC UA security policies that require authenticated sessions (disabling Anonymous security mode) would require PR:L/PR:H, eliminating unauthenticated exploitation paths, at the cost of additional client credential management overhead. Operators in safety-critical environments should assess whether temporary disabling of event-based monitored item subscription support (if configurable) is feasible as a hardening measure until a patch is available.