CVE-2026-35226 in CODESYS
Summary
by MITRE • 07/29/2026
An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same network segment to send malformed PROFINET communication data that triggers an exception in the affected PLC application. The exception is handled by the CODESYS Control runtime system and results in a controlled stop of the PLC application.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
This vulnerability represents a critical security flaw in CODESYS PROFINET Controller implementations that exposes industrial control systems to remote exploitation. The out-of-bounds write condition occurs when the system processes malformed PROFINET communication data without proper input validation, creating a memory corruption scenario that can be leveraged by attackers within the same network segment. This type of vulnerability falls under CWE-787: Out-of-bounds Write, which is classified as a severe memory safety issue in industrial control systems where such flaws can lead to system instability and operational disruption.
The technical execution of this vulnerability involves an unauthenticated attacker sending specially crafted PROFINET packets that trigger an exception within the CODESYS Control runtime environment. When the malformed data reaches the PLC application, it causes an exception handler to be invoked, which subsequently results in a controlled stop of the PLC application operations. This controlled stop represents a form of denial-of-service attack that can disrupt industrial processes and potentially lead to safety hazards in critical infrastructure environments where continuous operation is essential.
From an operational standpoint, this vulnerability presents significant risks to industrial organizations as it allows attackers to remotely terminate PLC applications without authentication requirements. The attack surface is limited to network segment access but remains highly dangerous due to the potential for disrupting critical manufacturing processes, power generation systems, or other industrial operations that rely on continuous PLC functionality. The impact extends beyond simple service interruption to potentially compromise operational technology infrastructure and create cascading failures in connected systems.
The vulnerability demonstrates a clear weakness in the CODESYS PROFINET Controller's input validation mechanisms and exception handling procedures. Industrial control systems should implement robust data validation and memory protection techniques to prevent such conditions from occurring. Organizations should ensure that their PLC applications perform proper bounds checking on all received network data and implement comprehensive exception handling that does not lead to application termination. Security measures should include network segmentation, intrusion detection systems, and regular firmware updates to address known vulnerabilities in industrial control system components.
This vulnerability aligns with ATT&CK technique T1499.001: Endpoint Denial of Service - File and Directory Permissions Modification, as it represents a form of service disruption that can be achieved through network-based attacks. The attack vector specifically relates to network-based exploitation of industrial control systems within the same broadcast domain, making it particularly dangerous in environments where physical security controls may not adequately protect against such threats. Implementation of proper network segmentation and access controls becomes essential to prevent unauthorized access to industrial control networks.
Organizations should implement mitigation strategies including network monitoring for unusual PROFINET traffic patterns, regular vulnerability assessments of industrial control systems, and immediate firmware updates from CODESYS when patches become available. The remediation process requires careful planning due to the critical nature of industrial operations, often necessitating scheduled maintenance windows to apply security updates without disrupting production processes. Additionally, implementing network access controls such as firewalls between industrial control networks and corporate networks can significantly reduce the attack surface for this type of vulnerability.
The broader implications of this vulnerability highlight the ongoing challenges in securing industrial control systems where legacy protocols and real-time requirements often conflict with modern security practices. Industrial organizations must balance operational continuity with security hardening, recognizing that vulnerabilities in control system components can have cascading effects throughout entire industrial processes. Regular security assessments, proper incident response planning, and continuous monitoring of industrial control network traffic are essential components of an effective security posture for protecting critical infrastructure from exploitation of such memory safety vulnerabilities.
This particular vulnerability demonstrates the importance of secure coding practices in industrial control systems where memory corruption issues can lead to complete system failures. The lack of authentication requirements for triggering the exploit makes this attack particularly concerning as it requires no prior access credentials or specialized knowledge beyond basic network reconnaissance. Security teams should prioritize identifying and patching similar vulnerabilities in their industrial control system environments, recognizing that these types of flaws often remain undetected for extended periods due to the specialized nature of industrial control protocols and the limited visibility into operational networks from traditional security monitoring tools.