PT-2026-39943 · Codesys · Codesys Modbus Tcp Server

Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-35227

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CODESYS Modbus TCP Server (affected versions not specified)

Description A race condition in connection handling allows an unauthenticated remote attacker to exhaust all available TCP connections in the CODESYS Modbus TCP Server stack. This leads to a denial of service, preventing legitimate clients from establishing new connections.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2026-35227

Affected Products

Codesys Modbus Tcp Server

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-35227 · Security Note
• https://t.me/cveNotify/163181 · Telegram Post
• https://certvde.com/de/advisories/VDE-2026-042 · Note