o6 Automation open62541

View CSAF
Summary
Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information, cause a denial of service, or potentially execute arbitrary code.
The following versions of o6 Automation open62541 are affected:

open62541 on Windows and Linux >=from_1.3.0|<=1.3.17 (CVE-2026-63362, CVE-2026-65423, CVE-2026-63035, CVE-2026-63559)
open62541 on Windows and Linux >=from_1.4.0|<=1.4.16 (CVE-2026-63362, CVE-2026-65423, CVE-2026-63035, CVE-2026-63559)
open62541 on Windows and Linux >=from_1.5.0|<=1.5.4 (CVE-2026-63362, CVE-2026-65423, CVE-2026-63035, CVE-2026-63559)
open62541 on Windows and Linux master (CVE-2026-63362, CVE-2026-65423, CVE-2026-63035, CVE-2026-63559)





CVSS
Vendor
Equipment
Vulnerabilities




v3 8.8
o6 Automation GmbH
o6 Automation open62541
Integer Underflow (Wrap or Wraparound), Integer Overflow or Wraparound, Use After Free




Background

Critical Infrastructure Sectors: Critical Manufacturing, Energy, Transportation Systems
Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany


Vulnerabilities

Expand All +

CVE-2026-63362

An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of service via a crafted UDP packet.
View CVE Details

Affected Products
o6 Automation open62541

Vendor:o6 Automation GmbH
Product Version:o6 Automation GmbH open62541 on Windows and Linux: >=from_1.3.0|<=1.3.17, o6 Automation GmbH open62541 on Windows and Linux: >=from_1.4.0|<=1.4.16, o6 Automation GmbH open62541 on Windows and Linux: >=from_1.5.0|<=1.5.4, o6 Automation GmbH open62541 on Windows and Linux: master Product Status:known_affected


Remediations
Mitigationo6 Automation has prepared mitigations and fixes to address these issues and recommends that users update to the newest version. The new version can be obtained by contacting o6 Automation https://www.o6-automation.com/contact or by downloading from the following locations:https://www.o6-automation.com/contact
Mitigationhttps://github.com/open62541/open62541/pull/8235/commits/b666d35769ce 63998442e4d0810a3fb10b50179fhttps://github.com/open62541/open62541/pull/8235/co mmits/b666d35769ce63998442e4d0810a3fb10b50179f Mitigationhttps://github.com/open62541/open62541/pull/8236/commits/06b99fef667c 8ec5bdf0605b4f00c84fcc1d3a60https://github.com/open62541/open62541/pull/8236/co mmits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60 Mitigationhttps://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4 d02d4729b8903a52e9f530bf804ehttps://github.com/open62541/open62541/pull/8237/co mmits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e Mitigationhttps://github.com/open62541/open62541/pull/8238/commits/afab4107bfd1 61da9ce8bb30ed77f3968c9c97dfhttps://github.com/open62541/open62541/pull/8238/co mmits/afab4107bfd161da9ce8bb30ed77f3968c9c97df
MitigationFor more information, see open62541 Security Advisories SA-2026-0012, SA-2026-0014, and SA-2026-0015 or contact o6 Automation: https://www.o6-automation.com/contacthttps://www.o6-automation.com/contact

Relevant CWE: CWE-191 Integer Underflow (Wrap or Wraparound)

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
5.9
MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H


4.0
8.2
HIGH
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N







CVE-2026-65423

An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write. View CVE Details

Affected Products
o6 Automation open62541

Vendor:o6 Automation GmbH
Product Version:o6 Automation GmbH open62541 on Windows and Linux: >=from_1.3.0|<=1.3.17, o6 Automation GmbH open62541 on Windows and Linux: >=from_1.4.0|<=1.4.16, o6 Automation GmbH open62541 on Windows and Linux: >=from_1.5.0|<=1.5.4, o6 Automation GmbH open62541 on Windows and Linux: master Product Status:known_affected


Remediations
Mitigationo6 Automation has prepared mitigations and fixes to address these issues and recommends that users update to the newest version. The new version can be obtained by contacting o6 Automation https://www.o6-automation.com/contact or by downloading from the following locations:https://www.o6-automation.com/contact
Mitigationhttps://github.com/open62541/open62541/pull/8235/commits/b666d35769ce 63998442e4d0810a3fb10b50179fhttps://github.com/open62541/open62541/pull/8235/co mmits/b666d35769ce63998442e4d0810a3fb10b50179f Mitigationhttps://github.com/open62541/open62541/pull/8236/commits/06b99fef667c 8ec5bdf0605b4f00c84fcc1d3a60https://github.com/open62541/open62541/pull/8236/co mmits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60 Mitigationhttps://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4 d02d4729b8903a52e9f530bf804ehttps://github.com/open62541/open62541/pull/8237/co mmits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e Mitigationhttps://github.com/open62541/open62541/pull/8238/commits/afab4107bfd1 61da9ce8bb30ed77f3968c9c97dfhttps://github.com/open62541/open62541/pull/8238/co mmits/afab4107bfd161da9ce8bb30ed77f3968c9c97df
MitigationFor more information, see open62541 Security Advisories SA-2026-0012, SA-2026-0014, and SA-2026-0015 or contact o6 Automation: https://www.o6-automation.com/contacthttps://www.o6-automation.com/contact

Relevant CWE: CWE-190 Integer Overflow or Wraparound

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
8.8
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H


4.0
8.7
HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N







CVE-2026-63035

A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code. View CVE Details

Affected Products
o6 Automation open62541

Vendor:o6 Automation GmbH
Product Version:o6 Automation GmbH open62541 on Windows and Linux: >=from_1.3.0|<=1.3.17, o6 Automation GmbH open62541 on Windows and Linux: >=from_1.4.0|<=1.4.16, o6 Automation GmbH open62541 on Windows and Linux: >=from_1.5.0|<=1.5.4, o6 Automation GmbH open62541 on Windows and Linux: master Product Status:known_affected


Remediations
Mitigationo6 Automation has prepared mitigations and fixes to address these issues and recommends that users update to the newest version. The new version can be obtained by contacting o6 Automation https://www.o6-automation.com/contact or by downloading from the following locations:https://www.o6-automation.com/contact
Mitigationhttps://github.com/open62541/open62541/pull/8235/commits/b666d35769ce 63998442e4d0810a3fb10b50179fhttps://github.com/open62541/open62541/pull/8235/co mmits/b666d35769ce63998442e4d0810a3fb10b50179f Mitigationhttps://github.com/open62541/open62541/pull/8236/commits/06b99fef667c 8ec5bdf0605b4f00c84fcc1d3a60https://github.com/open62541/open62541/pull/8236/co mmits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60 Mitigationhttps://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4 d02d4729b8903a52e9f530bf804ehttps://github.com/open62541/open62541/pull/8237/co mmits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e Mitigationhttps://github.com/open62541/open62541/pull/8238/commits/afab4107bfd1 61da9ce8bb30ed77f3968c9c97dfhttps://github.com/open62541/open62541/pull/8238/co mmits/afab4107bfd161da9ce8bb30ed77f3968c9c97df
MitigationFor more information, see open62541 Security Advisories SA-2026-0012, SA-2026-0014, and SA-2026-0015 or contact o6 Automation: https://www.o6-automation.com/contacthttps://www.o6-automation.com/contact

Relevant CWE: CWE-416 Use After Free

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
8.1
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H


4.0
7.2
HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N







CVE-2026-63559

An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to read out-of-bounds heap memory, potentially disclosing sensitive information. View CVE Details

Affected Products
o6 Automation open62541

Vendor:o6 Automation GmbH
Product Version:o6 Automation GmbH open62541 on Windows and Linux: >=from_1.3.0|<=1.3.17, o6 Automation GmbH open62541 on Windows and Linux: >=from_1.4.0|<=1.4.16, o6 Automation GmbH open62541 on Windows and Linux: >=from_1.5.0|<=1.5.4, o6 Automation GmbH open62541 on Windows and Linux: master Product Status:known_affected


Remediations
Mitigationo6 Automation has prepared mitigations and fixes to address these issues and recommends that users update to the newest version. The new version can be obtained by contacting o6 Automation https://www.o6-automation.com/contact or by downloading from the following locations:https://www.o6-automation.com/contact
Mitigationhttps://github.com/open62541/open62541/pull/8235/commits/b666d35769ce 63998442e4d0810a3fb10b50179fhttps://github.com/open62541/open62541/pull/8235/co mmits/b666d35769ce63998442e4d0810a3fb10b50179f Mitigationhttps://github.com/open62541/open62541/pull/8236/commits/06b99fef667c 8ec5bdf0605b4f00c84fcc1d3a60https://github.com/open62541/open62541/pull/8236/co mmits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60 Mitigationhttps://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4 d02d4729b8903a52e9f530bf804ehttps://github.com/open62541/open62541/pull/8237/co mmits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e Mitigationhttps://github.com/open62541/open62541/pull/8238/commits/afab4107bfd1 61da9ce8bb30ed77f3968c9c97dfhttps://github.com/open62541/open62541/pull/8238/co mmits/afab4107bfd161da9ce8bb30ed77f3968c9c97df
MitigationFor more information, see open62541 Security Advisories SA-2026-0012, SA-2026-0014, and SA-2026-0015 or contact o6 Automation: https://www.o6-automation.com/contacthttps://www.o6-automation.com/contact

Relevant CWE: CWE-190 Integer Overflow or Wraparound

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N


4.0
8.7
HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N








Acknowledgments

Asher Davila of Palo Alto Networks reported these vulnerabilities to CISA Abhinav Agarwal reported these vulnerabilities to CISA


Legal Notice and Terms of Use
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices
on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Revision History

Initial Release Date: 2026-07-30




Date
Revision
Summary




2026-07-30
1
Initial Publication




Legal Notice and Terms of Use

https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-08

2026-07-30 12:00 UTC

--- BBBS/LiR v4.10 Toy-7
* Origin: LISTS. from TCOB1 READ ONLY (2:263/1)