CODESYS Development System Local Privilege Escalation Vulnerability (CVE-2026-44469) Advisory

Vulnerability Overview Vulnerability ID: VDE-2026-055 Publication Date: May 26, 2026 Vendor: CODESYS GmbH External ID: Advisory2026-09_VDE-2026-055 Vulnerability Type: Privilege Escalation Vulnerability CVE IDs: CVE-2026-44469, CVE-2026-44468 CVSS Score: 7.8 Affected Scope Affected Product: CODESYS Development System Affected Versions: vers:generic/<3.5.22.20 Remediation Fixed Version: 3.5.22.20 Download Link: CODESYS Download Vulnerability Details Description: In the CODESYS Development System, PackageManager and IPM create temporary directories with insecure default permissions when executing with administrative privileges. This allows low-privileged local users to modify temporary boot files to force the deployment of arbitrary components or exploit a Time-of-Check to Time-of-Use (TOCTOU) race condition to replace digitally verified installation files. Both methods bypass the intended security boundaries during the installation of software packages or add-ons. Impact Successful Exploitation: Allows a low-privileged local attacker to achieve local privilege escalation. Since PackageManager and IPM run with elevated administrative privileges, any manipulated boot files or installation files will be installed in a high-privilege context, enabling the attacker to install arbitrary files to compromise the underlying operating system. Acknowledgements CERT@VDE: Coordination efforts David Ruscheweyh: Report from SEW-EURODRIVE GmbH & Co KG Revision History Version: 1.0.0 Date: May 26, 2026 Summary: Initial revision --- Note: The page does not contain POC code or exploit code.

Goal Reached Thanks to every supporter — we hit 100%!

CODESYS Development System Local Privilege Escalation Vulnerability (CVE-2026-44469) Advisory