High severity · published Mar 24, 2026
CVE-2026-3509
CODESYS Control Audit Log Format String DoS
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control runtime system, potentially resulting in a denial‑of‑service (DoS) condition.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
CODESYS Control RTE (SL) · CODESYS
3.5.17.0 before 3.5.22.0 · source: vendor
CC
CODESYS Control RTE (for Beckhoff CX) SL · CODESYS
3.5.17.0 before 3.5.22.0 · source: vendor
CC
CODESYS Control Win (SL) · CODESYS
3.5.17.0 before 3.5.22.0 · source: vendor
CC
CODESYS Control for BeagleBone SL · CODESYS
4.1.0.0 before 4.21.0.0 · source: vendor
CC
CODESYS Control for IOT2000 SL · CODESYS
4.1.0.0 before 4.21.0.0 · source: vendor
CC
CODESYS Control for Linux ARM SL · CODESYS
4.1.0.0 before 4.21.0.0 · source: vendor
CC
CODESYS Control for Linux SL · CODESYS
4.1.0.0 before 4.21.0.0 · source: vendor
CC
CODESYS Control for PFC100 SL · CODESYS
4.1.0.0 before 4.21.0.0 · source: vendor
CC
CODESYS Control for PFC200 SL · CODESYS
4.1.0.0 before 4.21.0.0 · source: vendor
CC
CODESYS Control for PLCnext SL · CODESYS
4.1.0.0 before 4.21.0.0 · source: vendor
CC
CODESYS Control for Raspberry Pi SL · CODESYS
4.1.0.0 before 4.21.0.0 · source: vendor
CC
CODESYS Control for WAGO Touch Panels 600 SL · CODESYS
4.1.0.0 before 4.21.0.0 · source: vendor
Affected product
CC
CODESYS Control for BeagleBone SL
CODESYS
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3509
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3509
certvde.com
https://certvde.com/de/advisories/VDE-2026-018
More from CODESYS Control for BeagleBone SL
8.8
CVE-2025-41660
CODESYS Control Boot Application Replacement Enables Code Execution
8.1
CVE-2026-8046
Incorrect Authorization in CODESYS Control
7.5
CVE-2026-8047
Out-of-bounds Write in CODESYS Control