OpenPLC Runtime v3: 1 CVE, Medium 6.1
Summary
CISA reports 1 vulnerability in Autonomy Logic OpenPLC. Weakness type: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Successful exploitation of this vulnerability could allow an attacker to hijack session cookies and issue state-changing requests as an operator which would allow the attacker to control the programmable logic controller and the physical processes it drives. Highest CVSS v3 score: 6.1 (Medium), exploitable over the network.
At a glance
- Vendor
- Autonomy Logic
- Products
- OpenPLC
- CVEs
- CVE-2026-88020
- Highest CVSS v3
- 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Energy, Transportation Systems, Water and Wastewater Systems
- Deployed
- Worldwide
- Vendor HQ
- United States
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-88020 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 6.1 | – | No | The affected product is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding. |
Affected products (1)
- Autonomy Logic OpenPLC: 3
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Autonomy Logic recommends users upgrade to OpenPLC v4 as OpenPLC v3 is end-of-life and is no longer receiving patches, bug fixes, or security updates.
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.