PT-2026-26701 · Automated Logic · Webctrl Premium Server

Published 2026-03-20 · Updated 2026-03-21 · CVE-2026-32666

Mitre

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

WebCTRL systems that communicate over BACnet inherit the protocol's lack of network layer authentication. WebCTRL does not implement additional validation of BACnet traffic so an attacker with network access could spoof BACnet packets directed at either the WebCTRL server or associated AutomatedLogic controllers. Spoofed packets may be processed as legitimate.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2026-32666

Affected Products

Webctrl Premium Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-32666 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-26-078-08 · Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json · Note
• https://automatedlogic.com/en/company/security-commitment · Note