CISA + vendors
ICS Advisories
Advisories specifically aimed at industrial control systems — from CISA ICS-CERT and directly from vendors (including Siemens, ABB, Schneider Electric, WAGO and Phoenix Contact) — including revision history (initial publication, Update A, Update B) and linked CVEs.
1
Found
Advisory data: live connection— last retrieved: 7 November 2026 at 02:05.
Filters
1 active1 advisories found
Advisory2026-01_VDE-2026-012
CODESYS Installer - Possible Privilege Escalation
Risk evaluation
The CODESYS Installer is affected by a privilege escalation vulnerability. Due to a race condition, a local attacker with limited privileges can replace the verified downloaded setup before execution. Because the update process runs with administrator privileges, a malicious application can be executed with elevated rights. The attack requires the legitimate user to confirm the self‑update prompt for the CODESYS Installer itself or to initiate an installation of a CODESYS Development System. The update process for CODESYS Add-Ons is not affected by this issue.
Mitigation summary
Update the following product to version 2.6.1.0. * CODESYS Installer The CODESYS Installer as well as the CODESYS Development System can be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.
Revision history (1)
Initial publication — 10 March 2026
Initial revision.