EUVD-2026-102000
GHSA-j9r2-33fg-6jg8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent-network foothold
-
DeliveryAuthenticate with low-privilege account
-
ExploitInduce operator to trigger affected workflow
-
ExecutionExploit incomplete resource cleanup (CWE-459)
-
PersistExhaust/degrade system resources
-
ImpactAvailability disruption of My Control System
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Incomplete cleanup
|
| Exploitation Conditions | Exploitation requires all of the following simultaneously: adjacent-network access to the My Control System host (AV:A - not routable from the internet), a valid low-privileged authenticated account (PR:L), and interaction from a legitimate user/operator (UI:R) to reach the vulnerable incomplete-cleanup code path. The specific triggering feature or configuration is not detailed in the available description beyond the CWE-459 incomplete-cleanup weakness; impact is confined to availability of versions 26.4 and 26.5. Limiting factors that reduce real-world risk: no remote/internet vector, mandatory authentication, mandatory user interaction, and no confidentiality or integrity impact. |
| Impact | This is a genuine but modest-priority issue, not a top-tier emergency. The CVSS 3.1 base score of 5.2 (Medium) reflects an adjacent-network vector (AV:A), low attack complexity (AC:L), a required low-privileged authenticated account (PR:L), and required user interaction (UI:R), with impact limited exclusively to availability (C:N/I:N/A:H) and no scope change (S:U). No EPSS score, CISA KEV listing, or public proof-of-concept is present in the supplied intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of adjacent-only reachability, authentication, and user-interaction prerequisites substantially narrows the realistic attacker population, which is consistent with the low-to-moderate severity. Note one cross-signal conflict: the 'Information Disclosure' tag contradicts the CVSS vector, which explicitly sets confidentiality and integrity to None and only availability to High - the CWE-459 (Incomplete Cleanup) weakness here manifests as an availability problem (e.g., residual resources), not data exposure; verify the tag with the vendor advisory. |
| Exploit ScenarioDerived | An attacker with a low-privileged account on the same adjacent network segment as a My Control System host induces a legitimate operator to perform an action that exercises a code path leaving resources improperly cleaned up. Repeated or crafted triggering of this incomplete-cleanup condition exhausts or degrades system resources, disrupting availability of the control-system management application. No public exploit code is known, and exploitation requires both adjacent access and user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Incomplete cleanup in ABB My Control System 26.4 and 26.5 allows an attacker who already has adjacent-network access and a valid low-privileged account to degrade or exhaust system resources on the affected host, resulting in a high availability impact while confidentiality and integrity remain unaffected. Exploitation is not trivial: it requires proximity to the system on the same network segment, authenticated access, and interaction from a legitimate operator to reach the vulnerable code path, which is why our independent assessment rates this as a genuine but modest-priority issue rather than an emergency. No confirmed active exploitation (no CISA KEV listing) and no public exploit code have been identified at time of analysis, and no EPSS score was supplied; the vendor's own advisory, ABB document 7PAA025438, is the authoritative source for the affected versions and fix guidance.
RemediationAI
Consult and follow ABB advisory 7PAA025438 (https://search.abb.com/library/Download.aspx?DocumentID=7PAA025438&LanguageCode=en&DocumentPartId=&Action=Launch); the supplied intelligence does not include a confirmed fixed release number, so the exact remediation version must be taken from that advisory rather than assumed-no vendor-released patch is identified in the data available at time of analysis beyond the advisory reference itself. If the fix from ABB cannot be applied immediately, the effective compensating controls are network-focused because the attack vector is adjacent-only: isolate the My Control System host into a dedicated control-system VLAN or zone with strict inter-zone filtering so that only specifically required engineering and operator workstations on defined ports and protocols can reach it, accepting the operational overhead of managing firewall rule sets and the risk that misconfigured segmentation breaks legitimate HMI/engineering traffic. In parallel, review and minimize low-privileged accounts that have authenticated access to the system, since the vector requires PR:L credentials-removing unused or shared operator accounts reduces the pool of usable footholds, at the cost of administrative effort and possible workflow disruption. Because exploitation also requires user interaction (UI:R), reinforce operator procedures to avoid triggering the vulnerable cleanup path until patched, and add monitoring for resource exhaustion symptoms such as handle, memory, or temporary-storage growth, service restarts, or unresponsiveness on versions 26.4 and 26.5, treating these as indicators that the incomplete-cleanup condition is being exercised. None of these controls eliminates the flaw; they only reduce reachability and detect abuse until the vendor fix is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-459, Incomplete Cleanup, a weakness class in which an application fails to properly release, delete, or reset resources-temporary files, locks, handles, buffers, sessions, or state records-after an operation completes. Over repeated invocations the accumulated residue typically manifests as resource exhaustion, degraded performance, or service unavailability, which matches the assessed impact profile of no confidentiality or integrity loss (C:N/I:N) but high availability loss (A:H). The CVSS vector CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H places this as an adjacent-network attack (AV:A), meaning the attacker must already be positioned on the same Layer 2/3 segment or an adjacent trusted network as the My Control System host rather than reaching it from the internet; authentication with a low-privileged account is mandatory (PR:L), and legitimate user or operator interaction is required to reach the vulnerable cleanup path (UI:R). The supplied CPE cpe:2.3:a:abb:my_control_system:*:*:*:*:*:*:*:* is fully wildcarded and therefore does not by itself confirm a version range, so the affected scope (26.4 and 26.5) is taken from the vendor description and should be verified against the ABB advisory. Note that the source tags label this as 'Information Disclosure', which is inconsistent with the assessed vector's absence of any confidentiality impact; the assessed availability-only impact and the CWE-459 cleanup class should be treated as authoritative over the tag.
Know when My Control System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Adjacent reach and an authenticated account plus operator interaction give AV:A/PR:L/UI:R; incomplete cleanup degrades availability only, so C:N/I:N/A:H.
Primary rating from Vendor (ABB).
CVSS VectorVendor: ABB
Lifecycle Timeline
1DescriptionCVE.org
Incomplete cleanup vulnerability in ABB My Control System.
This issue affects My Control System: 26.4 and 26.5.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB