CISA Advisory CSA-26-190-01: OpenPLC v3 Arbitrary Code Execution via CVE-2026-14480

Vulnerability Overview Vulnerability Name: OpenPLC v3 Release Date: July 9, 2026 Alert Code: CSA-26-190-01 Related Topics: Industrial Control Systems (ICS) Vulnerabilities, Industrial Control Systems Scope Affected Versions: OpenPLC v3 CVSS Score: v3 9.9 Vendor: OpenPLC Device: OpenPLC v3 Vulnerability Type: External Control of File Name or Path Remediation Recommended Practices: - Minimize the network exposure of all control system devices and/or systems, ensuring they are not accessible from the internet. - Place control system networks and remote devices behind firewalls and isolate them from business networks. - When remote access is required, use more secure remote access methods, such as Virtual Private Networks (VPNs), and recognize that VPNs may have vulnerabilities; ensure they are updated to the latest versions. - Before deploying defenses, CISA advises organizations to conduct appropriate impact analyses and risk assessments. - Implement recommended cybersecurity strategies to proactively defend ICS assets. - Follow internal procedures to report suspicious malicious activities for CISA to track and analyze for correlation. - Do not click links or open attachments in email messages to prevent social engineering attacks. Vulnerability Details CVE Number: CVE-2026-14480 Vulnerability Description: Successful exploitation of this vulnerability may allow an authenticated attacker to write arbitrary files to the file system and, through the normal OpenPLC program compilation process, escalate to arbitrary native code execution, potentially resulting in code execution as the user running the OpenPLC runtime. Additional Information Background: - Critical Infrastructure Sectors: Critical Manufacturing, Energy, Transportation Systems, Water and Wastewater - Geographic Deployment: Global - Company Headquarters Location: United States Credits: - Grady DeRosa reported this vulnerability to CISA. Revision History: - Initial Release Date: 2026-07-09 - Revision Number: 1 - Summary: Initial Release Related Links Notification: https://www.cisa.gov/notification Privacy and Usage Policy: https://www.cisa.gov/privacy-policy Tags Sectors: Critical Manufacturing Sector, Energy Sector, Transportation Systems Sector, Water and Wastewater Systems Sector Topics: Industrial Control Systems (ICS) Vulnerabilities, Industrial Control Systems Related Advisories Schneider Electric PowerChute Serial Shutdown Schneider Electric Easergy MiCOM Px40 Series Hitachi Energy e-mesh EMS Hitachi Energy PROMOD V Feedback Share Your Thoughts: We have recently updated our anonymous product survey; feedback is welcome. Footer CISA Central: 1-844-Say-CISA, contact@cisa.dhs.gov CISA.gov: Official website of the U.S. Department of Homeland Security About CISA: Budget and Performance, DHS.gov, FOIA Requests, No-FEAR Act, Office of Inspector General, Privacy Policy, Subscribe, White House, USA.gov, Website Feedback Summary This page details a critical vulnerability in OpenPLC v3 with a CVSS score of 9.9, impacting critical infrastructure sectors worldwide. CISA provides detailed remediation advice and best practices to minimize the risk associated with the vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

CISA Advisory CSA-26-190-01: OpenPLC v3 Arbitrary Code Execution via CVE-2026-14480