What is the CVSS score of EUVD-2026-52969?

EUVD-2026-52969 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of open62541 are affected by EUVD-2026-52969?

open62541 OPC UA servers with GDS PushManagement enabled are vulnerable to remote denial-of-service attacks that crash the server without requiring authentication or user interaction.

How to fix or mitigate EUVD-2026-52969?

Within 24 hours, identify all open62541 OPC UA servers with the UA_ENABLE_GDS_PUSHMANAGEMENT compile flag enabled and immediately restrict or disable access to GDS PushManagement endpoints using firewall rules to block unauthenticated external connections to OPC UA ports (typically port 4840). Within 7 days, complete a comprehensive inventory of affected systems, assess which installations cannot be isolated without disrupting operations, and document dependencies for each. Within 30 days, establish continuous monitoring of the open62541 project repository for patch releases and maintain a staging environment to validate patched versions before production deployment.

open62541 EUVD-2026-52969

| CVE-2026-67855 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-08-04 mitre

GHSA-cgjp-m25q-4wp8

Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable unauthenticated endpoint (PR:N, AV:N); AC:L because once the service is running with GDS enabled, attack requires no special conditions; impact is availability-only crash.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 21:31 vuln.today

CVSS changed

Aug 05, 2026 - 19:22 NVD

7.5 (HIGH)

CVE Published

Aug 04, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 04, 2026 - 00:00 cve.org

HIGH 7.5

DescriptionCVE.org

open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UA_ENABLE_GDS_PUSHMANAGEMENT is enabled. This allows a remote attacker to cause a denial of service.

AnalysisAI

Heap use-after-free in open62541's GDS PushManagement certificate update workflow enables remote unauthenticated denial of service against OPC UA servers built with the UA_ENABLE_GDS_PUSHMANAGEMENT compile-time flag. The vulnerability is remotely exploitable with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N per CVSS), crashing the affected server process. SSVC intelligence confirms a proof-of-concept exists and the attack is automatable, though EPSS at 0.17% (7th percentile) and absence from CISA KEV suggest exploitation remains limited or targeted as of time of analysis.

Technical ContextAI

open62541 is a widely-used open-source C implementation of the OPC UA (OPC Unified Architecture) protocol stack, used extensively in industrial control systems, SCADA environments, and IIoT applications. The Global Discovery Server (GDS) PushManagement subsystem handles certificate lifecycle operations - specifically pushing updated PKI certificates to OPC UA servers - and is gated behind the non-default compile-time flag UA_ENABLE_GDS_PUSHMANAGEMENT. The vulnerability resides in ua_server_ns0_gds.c and manifests as a heap use-after-free (CWE-416 is the precise root cause, though the NVD entry maps to CWE-400 Uncontrolled Resource Consumption - a likely mislabeling). When processing a crafted certificate update message, the GDS handler dereferences a heap pointer after the underlying memory has been freed, leading to a server crash. The CPE data provided (cpe:2.3:a:n/a:n/a) is non-specific and does not identify the exact open62541 version range, which limits precise product scoping.

RemediationAI

No vendor-released patched version has been identified at time of analysis - the available references point to the upstream GitHub repository (https://github.com/open62541/open62541), the issue tracker (https://github.com/open62541/open62541/issues/8093), and specific source files (ua_server_ns0_gds.c, ua_server_internal.h), but no tagged release or fix commit is confirmed. Monitor the open62541 issue #8093 for patch availability and upgrade to a patched release once one is published. The most actionable immediate compensating control is to recompile open62541 without UA_ENABLE_GDS_PUSHMANAGEMENT if the GDS certificate push feature is not operationally required - this eliminates the vulnerable code path entirely and has no impact on core OPC UA server functionality. If GDS PushManagement is required, restrict network access to the OPC UA server endpoint to trusted GDS clients only via firewall or network segmentation rules; note this reduces exposure but does not eliminate it if the attacker can reach the endpoint from a permitted segment. Verify all open62541 build configurations across the fleet to identify exposed instances.