PT-2026-50774 · Azeotech · Daqfactory

God + 2 · CVE-2026-12390 · Published 2026-06-18 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions AzeoTech DAQFactory versions prior to 21.2

Description A Type Confusion issue exists where an attacker can use specially crafted .ctl files to achieve arbitrary code execution. Type Confusion occurs when a program accesses a resource using a type that is different from the type it was originally allocated with, leading to unexpected behavior.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Password-protect .ctl documents as a mitigation measure.

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

CVE-2026-12390

ZDI-26-449

Affected Products

Daqfactory

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-12390 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-26-449 · Security Note
• https://twitter.com/CVEnew/status/2067717393548202240 · Twitter Post
• https://twitter.com/aviatrixtrc/status/2068009061254136063 · Twitter Post
• https://twitter.com/Alpaca744/status/2067683379940610512 · Twitter Post
• https://t.me/cveNotify/172490 · Telegram Post
• https://t.me/cveNotify/170727 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-26-169-02 · Note
• https://twitter.com/infoflowcloud/status/2067718145909968960 · Twitter Post