High severity · published Sep 30, 2026
CVE-2026-79625
Improper Synchronization in Monitoring in CODESYS Control Runtime
8.1
CVSS
0.2%
EPSS
No
On KEV
Description
Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit this issue to cause incorrect data processing or a denial-of-service condition.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
Control RTE (SL) · CODESYS
3.0.0.0 before 3.5.22.40 · source: vendor
CR
Control RTE (for Beckhoff CX) SL · CODESYS
3.0.0.0 before 3.5.22.40 · source: vendor
CW
Control Win (SL) · CODESYS
3.0.0.0 before 3.5.22.40 · source: vendor
CF
Control for BeagleBone SL · CODESYS
3.5.0.0 before 4.23.0.0 · source: vendor
CF
Control for IOT2000 SL · CODESYS
3.5.0.0 before 4.23.0.0 · source: vendor
CF
Control for Linux ARM SL · CODESYS
3.5.0.0 before 4.23.0.0 · source: vendor
CF
Control for Linux SL · CODESYS
3.5.0.0 before 4.23.0.0 · source: vendor
CF
Control for PFC100 SL · CODESYS
3.5.0.0 before 4.23.0.0 · source: vendor
CF
Control for PFC200 SL · CODESYS
3.5.0.0 before 4.23.0.0 · source: vendor
CF
Control for PLCnext SL · CODESYS
3.5.0.0 before 4.23.0.0 · source: vendor
CF
Control for Raspberry Pi SL · CODESYS
3.5.0.0 before 4.23.0.0 · source: vendor
CF
Control for WAGO Touch Panels 600 SL · CODESYS
3.5.0.0 before 4.23.0.0 · source: vendor
Affected product
CF
Control for BeagleBone SL
CODESYS
More from Control for BeagleBone SL
9.8
CVE-2019-9010
An issue was discovered in 3S-Smart CODESYS V3 products
9.8
CVE-2018-10612
In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which…
8.8
CVE-2023-6357
OS Command Injection in multiple CODESYS products
8.8
CVE-2022-4046
CODESYS: Improper memory restrictions fro CODESYS Control
8.8
CVE-2022-47390
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write…