CVE-2026-79625
Improper Synchronization in Monitoring in CODESYS Control Runtime
CODESYS Control RTE (SL)
CVSS
7.2HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.5.22.40Control RTE (SL)CVE List
- 3.5.22.40Control RTE (for Beckhoff CX) SLCVE List
- 3.5.22.40Control Win (SL)CVE List
- 3.5.22.40Runtime ToolkitCVE List
- 3.5.22.40Safety SIL2CVE List
- 3.5.22.40HMI (SL)CVE List
Show all 18 fixed versions
- 3.5.22.40Development System 3CVE List
- 4.23.0.0Control for BeagleBone SLCVE List
- 4.23.0.0Control for emPC-A/iMX6 SLCVE List
- 4.23.0.0Control for IOT2000 SLCVE List
- 4.23.0.0Control for Linux ARM SLCVE List
- 4.23.0.0Control for Linux SLCVE List
- 4.23.0.0Control for PFC100 SLCVE List
- 4.23.0.0Control for PFC200 SLCVE List
- 4.23.0.0Control for PLCnext SLCVE List
- 4.23.0.0Control for Raspberry Pi SLCVE List
- 4.23.0.0Control for WAGO Touch Panels 600 SLCVE List
- 4.23.0.0Virtual Control SLCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit this issue to cause incorrect data processing or a denial-of-service condition.
Text from CVE List
Affected versions 18
- Control RTE (SL)affected: 3.0.0.0 before 3.5.22.40CVE List
- Control RTE (for Beckhoff CX) SLaffected: 3.0.0.0 before 3.5.22.40CVE List
- Control Win (SL)affected: 3.0.0.0 before 3.5.22.40CVE List
- Runtime Toolkitaffected: 3.0.0.0 before 3.5.22.40CVE List
- Safety SIL2affected: 3.0.0.0 before 3.5.22.40CVE List
- HMI (SL)affected: 3.0.0.0 before 3.5.22.40CVE List
- Development System 3affected: 3.0.0.0 before 3.5.22.40CVE List
- Control for BeagleBone SLaffected: 3.5.0.0 before 4.23.0.0CVE List
- Control for emPC-A/iMX6 SLaffected: 3.5.0.0 before 4.23.0.0CVE List
- Control for IOT2000 SLaffected: 3.5.0.0 before 4.23.0.0CVE List
- Control for Linux ARM SLaffected: 3.5.0.0 before 4.23.0.0CVE List
- Control for Linux SLaffected: 3.5.0.0 before 4.23.0.0CVE List
- Control for PFC100 SLaffected: 3.5.0.0 before 4.23.0.0CVE List
- Control for PFC200 SLaffected: 3.5.0.0 before 4.23.0.0CVE List
- Control for PLCnext SLaffected: 3.5.0.0 before 4.23.0.0CVE List
- Control for Raspberry Pi SLaffected: 3.5.0.0 before 4.23.0.0CVE List
- Control for WAGO Touch Panels 600 SLaffected: 3.5.0.0 before 4.23.0.0CVE List
- Virtual Control SLaffected: 3.5.0.0 before 4.23.0.0CVE List