CISA + vendors

ICS Advisories

Advisories specifically aimed at industrial control systems — from CISA ICS-CERT and directly from vendors (including Siemens, ABB, Schneider Electric, WAGO and Phoenix Contact) — including revision history (initial publication, Update A, Update B) and linked CVEs.

Found

Advisory data: live connection— last retrieved: 7 November 2026 at 01:04.

Filters

1 active

Reset filters

Search: FSA-202601

Vendor

Protocol

Sector

Severity

Source

1 advisories found

FSA-202601

Several CODESYS vulnerabilities in Festo Automation Suite

Festo — CODESYS Development System

Festo PSIRTcritical

Published

26 February 2026

Last update

26 February 2026

Linked CVEs

CVE-2025-2595 CVE-2010-5250 CVE-2017-3735 CVE-2018-0739 CVE-2018-10612 CVE-2018-20025 CVE-2018-20026 CVE-2019-13538 CVE-2019-5105 CVE-2019-9009 CVE-2019-9010 CVE-2019-9012 CVE-2020-10245 CVE-2020-12068 CVE-2020-14509 CVE-2020-14513 CVE-2020-14515 CVE-2020-14517 CVE-2020-14519 CVE-2020-16233 CVE-2020-7052 CVE-2021-21868 CVE-2021-21869 CVE-2021-29239 CVE-2021-29240 CVE-2021-29241 CVE-2021-29242 CVE-2021-30186 CVE-2021-30188 CVE-2021-30190 CVE-2021-30195 CVE-2021-33485 CVE-2021-34593 CVE-2021-36763 CVE-2022-22513 CVE-2022-22514 CVE-2022-22515 CVE-2022-22517 CVE-2022-22519 CVE-2022-31806 CVE-2022-47378 CVE-2022-47379 CVE-2022-47380 CVE-2022-47381 CVE-2022-47383 CVE-2022-47384 CVE-2022-47385 CVE-2022-47387 CVE-2022-47388 CVE-2022-47389 CVE-2022-47390 CVE-2022-47391 CVE-2022-47392 CVE-2022-47393 CVE-2023-3935 CVE-2023-6357 CVE-2024-5000 CVE-2025-0694 CVE-2025-1468 CVE-2025-41658 CVE-2025-41659 CVE-2020-11023 CVE-2022-47382

Affected sectors

Risk evaluation

Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently. This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite. Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.

Mitigation summary

Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

Revision history (1)

Initial publication — 26 February 2026
Initial version

Official source: Festo PSIRT