CISA flags CVE-2026-14480 in OpenPLC v3
End-of-life software turns a bad authenticated bug into an upgrade mandate, which is tidy advice until the plant cannot move that fast.
TL;DR
CISA published ICSA-26-190-01 for OpenPLC v3, warning that CVE-2026-14480 carries a CVSS 3.1 score of 9.9. The flaw lets an authenticated attacker write arbitrary files and potentially reach native code execution through OpenPLC’s normal compilation process. OpenPLC recommends upgrading to v4 because v3 is end-of-life; CISA says it has no reports of known public exploitation.
For defense-industrial-base contractors, C3PAOs, assessors, and critical-infrastructure operators with OpenPLC v3 anywhere in production, test, training, or client environments, the Monday work is inventory and upgrade planning. CISA’s advisory covers a legacy web UI program-upload flaw that stores an attacker-supplied filename and later uses it as a filesystem path, allowing arbitrary writes by an authenticated user. Because the runtime build process compiles C++ files in the OpenPLC runtime core directory, that write can become code execution when an operator runs a normal compilation and start.
The vendor answer is simple: move to OpenPLC v4. The operational answer may not be. OpenPLC v3 is end-of-life and no longer receiving patches, bug fixes, or security updates, so there is no vendor patch track to wait for. CISA’s generic industrial control system guidance still applies: reduce network exposure, put control system networks behind firewalls, isolate them from business networks, and assess impact before defensive changes. What the advisory does not supply is an interim product-specific mitigation for sites that cannot replace v3 immediately without disrupting operational continuity. That is the usual ICS patch-burden problem, just with a CVSS 9.9 label attached.
Published ·Deep Fathom