OpenPLC v3 XSS Lets Attackers Seize Control of ICS
End-of-life software running critical infrastructure leaves operators with two choices: upgrade to v4 or isolate the box from anything that runs a browser.
TL;DR
CISA disclosed CVE-2026-88020, a cross-site scripting vulnerability in OpenPLC Runtime v3 that lets unauthenticated remote attackers steal session cookies and issue operator commands controlling physical processes. OpenPLC v3 is end-of-life, no patches, no bug fixes, no security updates. The vendor and CISA both point to upgrading to v4 as the remedy. Sectors affected: critical manufacturing, energy, water, and transportation. This is the fourth CISA advisory on OpenPLC v3 since September 2025.
The advisory lands with a familiar structure: CISA details a vulnerability, the vendor confirms the affected version is end-of-life, and the guidance is to upgrade to v4. CVE-2026-88020 earned a CVSS v4 score of 5.3 (MEDIUM), but the CVSS score doesn't capture the operational calculus here. The web interface routes requests based on an unencoded query string parameter, so an attacker who tricks an authenticated operator into clicking a crafted link can hijack their session. Once inside, the attacker isn't browsing, they're starting and stopping processes, altering setpoints, or uploading malicious ladder logic to the PLC.
The CVSS vector assumes user interaction (UI:P). In practice, the user interaction is the operator checking email or opening a browser tab on a machine with access to the OpenPLC web interface. That's the standard workflow at plenty of facilities. The score reflects the technical attack path, not the likelihood that the path exists in production.
OpenPLC v3 has now been the subject of four CISA advisories since September 2025. The previous three covered an authenticated arbitrary-file-write-to-code-execution chain (CVE-2026-14480, CVSS 9.9), CSRF and plaintext credential storage (CVE-2025-13970 and related), and a remote unauthenticated denial-of-service (CVE-2025-54811). The new XSS fits a pattern: a web interface designed for convenience in a product that's no longer maintained, deployed in environments where it controls physical equipment.
What the operator does Monday
The decision tree has exactly two branches. Either upgrade to OpenPLC Runtime v4, which is the only remediated path, or isolate v3 systems so completely that no machine with a browser can reach them. The second option means removing the web interface from any network segment that also carries email or web traffic. That's often the whole reason the web interface was there in the first place, so "isolate" and "keep using" may be in tension depending on how the facility was architected.
Published ·Deep Fathom