PT-2026-27353 · Codesys · Codesys Control Rte+14

Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-3509

Mitre

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control runtime system, potentially resulting in a denial‑of‑service (DoS) condition.

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2026-3509

Affected Products

Codesys Control Rte

Codesys Control Rte (For Beckhoff Cx) Sl

Codesys Control Win

Codesys Control For Beaglebone

Codesys Control For Iot2000

Codesys Control For Linux Arm Sl

Codesys Control For Linux

Codesys Control For Pfc100

Codesys Control For Pfc200

Codesys Control For Plcnext

Codesys Control For Raspberry Pi

Codesys Control For Wago Touch Panels 600 Sl

Codesys Control For Empc-A/Imx6

Codesys Runtime Toolkit

Codesys Virtual Control Sl

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-3509 · Security Note
• https://certvde.com/de/advisories/VDE-2026-018 · Note