8
CVEs
1
Critical
4
High
0
KEV
3
PoC
5
Unpatched C/H
25.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
4
MEDIUM
2
LOW
1
Monthly CVE Trend
Affected Products (2)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-49035 | Remote code execution in MZ Automation's libiec61850 IEC 61850 library is possible via a crafted MMS Initiate request that triggers a heap-based buffer overflow (CWE-122); RCE was demonstrated on hosts with ASLR disabled, while ASLR-enabled deployments face memory corruption or denial of service. Any device or application embedding this library and exposing the MMS/TCP (typically port 102) service to attacker-reachable networks is affected. Reported through CISA ICS-CERT (ICSA-26-204-06); no public exploit identified at time of analysis and no EPSS/KEV signal is present in the source data. | CRITICAL | 9.2 | 0.4% | 56 |
No patch
|
| CVE-2026-16002 | Denial-of-service in MZ Automation's lib60870, an open-source IEC 60870-5-101/104 telecontrol protocol library used in ICS/SCADA systems, allows remote attackers to crash the message-parsing process via a malformed protocol frame that triggers an out-of-bounds read (CWE-125). The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high availability impact and limited confidentiality exposure. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. | HIGH | 8.8 | 0.3% | 54 |
No patch
|
| CVE-2026-50039 | Denial of service in MZ Automation's libiec61850 library allows remote unauthenticated attackers to corrupt memory by sending a crafted Read Request, triggering a stack-based buffer overflow (CWE-121). The flaw affects the IEC 61850 MMS server implementation used in power-grid and industrial automation devices, and was disclosed via a CISA ICS advisory (ICSA-26-204-06). No public exploit is identified at time of analysis, and the vendor CVSS 4.0 vector scores only availability impact, indicating a service crash rather than confirmed code execution. | HIGH | 8.7 | 0.3% | 54 |
No patch
|
| CVE-2026-50032 | Denial of service in MZ Automation's libiec61850 library allows a network-adjacent attacker to crash an IEC 61850 MMS server by sending a specially crafted WriteRequest whose listOfData field is empty, triggering a NULL pointer dereference (CWE-476) in the Write Named Variable List handler. Any device or application embedding the affected library as an MMS server - commonly protection relays, RTUs, gateways, and SCADA front-ends in electric-power and industrial environments - is exposed. Reported through CISA ICS-CERT (advisory ICSA-26-204-06) with no public exploit identified at time of analysis and no CISA KEV listing. | HIGH | 8.7 | 0.3% | 54 |
No patch
|
| CVE-2026-18582 | Remote unauthenticated crash in mz-automation libiec61850 1.6.0-1.6.1 allows a network attacker to terminate an IEC 61850 MMS server by supplying an oversized Report ID string to the Report Control Block write handler, triggering a free of non-heap memory (CWE-590). No authentication or user interaction is required per the CVSS 4.0 vector (PR:N/UI:N/AV:N), and a public proof-of-concept exploit exists at the referenced GitHub issue. Active exploitation has not been confirmed by CISA KEV, but the combination of a public PoC and trivial exploitation path elevates practical risk in operational technology environments where IEC 61850 server continuity is safety-critical. | MEDIUM | 5.5 | 0.5% | 48 |
PoC
|
| CVE-2026-18583 | Out-of-bounds read in mz-automation libiec61850 up to version 1.6.1 allows remote unauthenticated attackers to crash the IEC 61850 MMS server process and potentially leak heap or stack memory contents by sending a crafted MMS DataSet access request. The root cause is unconstrained string copy operations in the checkDataSetAccess function, now confirmed fixed in v1.6.2 via bounded copy with a 129-byte limit. A public exploit has been disclosed; however, this vulnerability is not listed in CISA KEV and the CVSS 4.0 score of 6.9 (Medium) reflects limited impact scope confined to availability of the vulnerable system. | MEDIUM | 5.5 | 0.5% | 48 |
PoC
|
| CVE-2026-50103 | Denial of service in MZ Automation's libiec61850 lets a network-adjacent attacker crash any application subscribing to GOOSE traffic by transmitting a single crafted L2 GOOSE or R-GOOSE frame carrying a malformed TLV. Because the fault lives in the shared parser used by both the Layer-2 and routable variants, both transport modes are affected, and successful exploitation produces a NULL pointer dereference that terminates the subscriber process. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; the CVSS 4.0 base score is 7.1 with availability-only impact. | HIGH | 7.1 | 0.2% | 46 |
No patch
|
| CVE-2026-19259 | Heap-based buffer overflow in MZ Automation libiec61850 up to version 1.6.1 allows a local attacker with low privileges to corrupt heap memory by supplying a crafted GetNamedVariableListAttributesResponse itemId argument to the MmsMapping_varAccessSpecToObjectReference function in the MMS Protocol Workflow. A public proof-of-concept exploit has been released and is available for download. The vulnerability has not yet been patched; the project was notified via GitHub issue #599 but has not responded at time of analysis. No active exploitation is confirmed by CISA KEV, though the publicly available PoC meaningfully elevates near-term risk. | LOW | 1.9 | 0.1% | 30 |
PoC
No patch
|