CVE-2026-62927 in Milo
Summary
by MITRE • 08/04/2026
In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/04/2026
The vulnerability in Eclipse Milo versions 1.0.0 through 1.1.4 represents a critical authorization bypass flaw that undermines the security model of the OPC UA stack implementation. This issue manifests within the Call service functionality where the system processes batched requests in a manner that fails to properly isolate privileged operations from unauthorized ones. The fundamental technical flaw occurs when the system calculates authorization for the entire batch before dispatching individual requests to address-space handlers, creating a scenario where malicious clients can exploit this timing gap to execute denied operations through legitimate method calls.
The operational impact of this vulnerability extends beyond simple privilege escalation as it allows attackers to perform unauthorized actions by carefully crafting batched requests that combine privileged operations with allowed ones. This pattern enables anonymous users or low-privileged clients to bypass access controls and execute methods they would normally be denied, effectively creating a backdoor mechanism within the OPC UA communication framework. The vulnerability specifically affects industrial control systems that rely on Eclipse Milo for OPC UA server implementations, potentially compromising the integrity of critical infrastructure operations.
This authorization bypass aligns with CWE-284 Access Control flaws and represents a classic example of improper privilege management in service dispatch mechanisms. The flaw demonstrates weaknesses in the security model's design where batch processing logic fails to maintain proper isolation between different privilege levels during request execution. From an ATT&CK perspective, this vulnerability maps to privilege escalation techniques and can be leveraged as part of broader attack chains targeting industrial control systems. The issue particularly affects systems implementing OPC UA security controls where batched method calls are common in industrial automation scenarios.
Organizations using affected Eclipse Milo versions should immediately implement mitigations including upgrading to patched releases that properly isolate batched request processing, implementing additional authorization checks at the individual method level, and configuring strict access controls for OPC UA services. The recommended approach involves ensuring that authorization decisions are made on a per-request basis rather than per-batch, preventing the mixing of privileged and non-privileged operations within single dispatch cycles. Security monitoring should also be enhanced to detect anomalous batched request patterns that might indicate exploitation attempts against this vulnerability.
The broader implications of this flaw extend to industrial cybersecurity practices, particularly in environments where OPC UA servers handle critical operations in manufacturing, energy, or process control systems. The vulnerability highlights the importance of proper security architecture design in industrial protocols and demonstrates how seemingly minor implementation details can create significant security weaknesses. Organizations should conduct comprehensive security assessments of their OPC UA implementations to identify similar authorization bypass opportunities and ensure that all batch processing mechanisms properly enforce access controls at the individual operation level rather than at the batch aggregation stage.