Which versions of ibaPDA are affected by EUVD-2026-37869?

A critical unauthenticated remote code execution vulnerability (CVE-2026-8024, CVSS 9.3) in iba ibaPDA and ibaDatCoordinator enables attackers to gain complete system control over affected industrial…. A patch is available.

How to fix or mitigate EUVD-2026-37869?

Within 24 hours: Conduct immediate inventory of all ibaPDA and ibaDatCoordinator deployments and their network connectivity; prioritize any internet-connected or remotely accessible instances. Within 7 days: Implement network-level protections including firewall rules restricting untrusted network access and VPN/authentication requirements for any remote connections; enable enhanced monitoring and logging on affected systems. Within 30 days: Actively monitor iba security advisories for patch availability; develop and test an expedited deployment plan for rapid patch application once vendor releases a fix.

ibaPDA EUVD-2026-37869

Q: What is the CVSS score of EUVD-2026-37869?

EUVD-2026-37869 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

| CVE-2026-8024 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-18 CERTVDE

GHSA-29x2-9v4j-q39r

Deserialization Ibapda Ibadatcoordinator

9.3

CVSS 4.0 · Vendor: CERTVDE

Severity by source

Vendor (CERTVDE) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Description states a remote unauthenticated attacker gains full access via deserialization, so AV:N/AC:L/PR:N/UI:N with full C/I/A impact and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CERTVDE).

CVSS VectorVendor: CERTVDE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 18, 2026 - 12:16 EUVD

Analysis Generated

Jun 18, 2026 - 11:15 vuln.today

DescriptionCVE.org

A remote, unauthenticated attacker may exploit a deserialization of untrusted data vulnerability in ibaPDA or ibaDatCoordinator to gain full access to the affected systems.

AnalysisAI

Remote code execution in iba ibaPDA and ibaDatCoordinator allows unauthenticated network attackers to gain full system control by exploiting an unsafe deserialization flaw (CWE-502). The CVSS 4.0 score of 9.3 reflects network-reachable exploitation with no privileges or user interaction and high impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the trivial attack profile makes it a high priority for industrial environments running these data acquisition products.

Technical ContextAI

ibaPDA is a process data acquisition system and ibaDatCoordinator is its companion data management/archival service, both widely used in industrial automation and manufacturing for collecting measurement and process signals. The flaw is a CWE-502 Deserialization of Untrusted Data weakness, in which the affected components deserialize attacker-controlled byte streams without validating the object graph, allowing instantiation of dangerous gadget chains that lead to arbitrary code execution. This class of bug commonly arises in .NET or Java services that expose a network listener accepting serialized objects (e.g. BinaryFormatter, NetDataContractSerializer, or similar), and the CPE entries cpe:2.3:a:iba:ibapda and cpe:2.3:a:iba:ibadatcoordinator confirm both products share the vulnerable code path.

RemediationAI

Patch availability is indicated by the CERT@VDE coordinated advisory VDE-2026-051 but the input does not contain an exact fixed version, so treat this as: patch available per vendor advisory - consult https://certvde.com/en/advisories/VDE-2026-051 and the CSAF feed at https://iba.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-051.json for the precise upgrade target for ibaPDA and ibaDatCoordinator and upgrade promptly. Until patched, restrict TCP access to the ibaPDA and ibaDatCoordinator service ports to a small allow-list of engineering workstations via host firewalls or ICS network segmentation (Purdue zone boundary or VLAN ACLs), which removes the network attack surface at the cost of blocking remote clients that legitimately consume the data feed; if the service must remain reachable, place it behind a VPN or jump host with strong authentication and monitor for anomalous serialized payloads, accepting that this does not stop attackers who already have a foothold on the trusted segment.