Which versions of CODESYS Control are affected by CVE-2026-8046?

CODESYS Control runtime (affected versions below 3.5.22.20 and 4.21.0.0) contains a privilege escalation vulnerability allowing authenticated low-privileged remote users to delete administrator…. A patch is available.

How to fix or mitigate CVE-2026-8046?

Within 24 hours: Inventory all CODESYS Control deployments and identify systems running versions below 3.5.22.20 (3.x branch) or below 4.21.0.0 (4.x branch). Within 7 days: Apply vendor-released patches to upgrade CODESYS Control to version 3.5.22.20 or later (3.x line) and version 4.21.0.0 or later (4.x line) across all affected systems. Within 30 days: Verify patch deployment completion, audit account deletion logs for any unauthorized deletion attempts, and validate that administrative account protection controls are functioning properly.

CODESYS Control CVE-2026-8046

Q: What is the CVSS score of CVE-2026-8046?

CVE-2026-8046 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-31799 HIGH

Incorrect Authorization (CWE-863)

2026-05-26 CERTVDE

GHSA-h6mv-mgpj-6795

7.2

CVSS 4.0 · Vendor: CERTVDE

Severity by source

Vendor (CERTVDE) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CERTVDE) · only source for this CVE.

CVSS VectorVendor: CERTVDE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:21 vuln.today

CVSS changed

May 26, 2026 - 13:37 NVD

8.1 (HIGH) 7.2 (HIGH)

Patch available

May 26, 2026 - 09:01 EUVD

CVE Published

May 26, 2026 - 06:45 nvd

HIGH 7.2

DescriptionCVE.org

The affected products insufficiently verify authorization when deleting user accounts. An authenticated, low-privileged remote user can exploit this vulnerability to delete other users, including those with higher privileges.

AnalysisAI

Privilege escalation through unauthorized account deletion in CODESYS Control runtime products (versions below 3.5.22.20 / 4.21.0.0) allows authenticated low-privileged remote users to delete other accounts, including administrators. Reported by CERT@VDE under advisory VDE-2026-056, with no public exploit identified at time of analysis and a low EPSS score of 0.10% (26th percentile), suggesting limited near-term exploitation likelihood despite the vendor-confirmed authorization flaw.

Technical ContextAI

CODESYS is a widely deployed industrial automation runtime used to execute IEC 61131-3 PLC programs on embedded controllers, edge devices, and soft-PLCs across vendors such as WAGO, Beckhoff, Raspberry Pi, BeagleBone, and Siemens IOT2000. The flaw is classified as CWE-863 (Incorrect Authorization): the user-management component of the CODESYS Runtime performs an authentication check but fails to verify that the calling principal has sufficient privileges before honoring a delete-user request. Affected CPE entries cover the Control RTE, Control Win, HMI, Runtime Toolkit, and a broad family of Control for Linux/ARM/BeagleBone/IOT2000/PFC/Raspberry Pi/emPC packages, indicating the defective authorization logic lives in shared runtime code reused across the product line.

RemediationAI

Apply the vendor-released patches: upgrade the 3.5.x runtime products (Control Win SL, HMI SL, Runtime Toolkit, Control RTE SL, Control RTE for Beckhoff CX SL) to 3.5.22.20 or later, and upgrade the 4.x SL runtimes (Control for PLCnext, Linux, Linux ARM, Virtual Control, emPC-A/iMX6, WAGO Touch Panels 600, BeagleBone, Raspberry Pi, PFC200, PFC100, IOT2000) to 4.21.0.0 or later as listed in CERT@VDE advisory VDE-2026-056 (https://www.certvde.com/en/advisories/VDE-2026-056/). Until patching is feasible, restrict network reachability of the CODESYS runtime communication port (default TCP 11740/UDP 1740) to engineering workstations via firewall ACLs or segmentation, and remove or disable low-privileged runtime user accounts that are not strictly required - note that aggressive ACLs can interfere with legitimate engineering tool connectivity and HMI polling, and disabling user accounts may break operator workflows that rely on tiered access. Audit existing runtime user lists for unexpected deletions or missing administrators before and after patching, since the flaw could already have been used to remove accounts.