Medium severity · published Jul 16, 2026
CVE-2026-60073
AutomationDirect Productivity Suite Out-of-bounds Read
5.9
CVSS
0.2%
EPSS
No
On KEV
Description
An out-of-bounds read in the Productivity Suite allows a physical
attacker to control the length of data sent to a USB device. This can
lead to a system crash or disclosure of kernel memory.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack vector
Physical
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PS
Productivity Suite · AutomationDirect
through v4.6.2.2 · source: vendor
In the news
VulnerabilityHigh
AutomationDirect Productivity Suite
View CSAF
Summary
Successful exploitation of these vulnerabilities could allow an attacker with local or physical access to cause memory corruption, unintended information disclosure, application instability, or a denial-of-service condition in the affected product.
The following versions of AutomationDirect Productivity Suite are affected:
Productivity Suite <=v4.6.2.2 (CVE-2026-60063, CVE-2026-61389, CVE-2026-60140, CVE-2026-57896, CVE-2026-60073, CVE-2026-61378)
CVSS
Vendor
Equipment
Vulnerabilities
v3 7
AutomationDirect
AutomationDirect Productivity Suite
Out-of-bounds Write, Out-of-bounds Read, Divide By Zero
Background
Critical Infrastructure Sectors: Critical Manufacturing
Countries/Areas Deployed: Worldwide
Company Headquarters Location: United States
Vulnerabilities
Expand All +
CVE-2026-60063
An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability.
View CVE Details
Affected Products
AutomationDirect Productivity Suite
Vendor: AutomationDirect
Product Version: AutomationDirect Productivity Suite: <=v4.6.2.2
Product Status: known_affected
Remediations
Mitigation AutomationDirect recommends that users update Productivity suite to v4.7.0.47 and above https://www.automationdirec...
Jul 16, 2026·CISA Advisories
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-60073
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-60073
github.com
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-197-04.json
www.automationdirect.com
https://www.automationdirect.com/support/software-downloads
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-04
More from Productivity Suite
10.0
CVE-2025-61934
AutomationDirect Productivity Suite Binding to an Unrestricted IP Address CWE-1327
8.8
CVE-2025-62498
AutomationDirect Productivity Suite Relative Path Traversal
7.5
CVE-2025-58429
AutomationDirect Productivity Suite Relative Path Traversal
7.5
CVE-2025-58078
AutomationDirect Productivity Suite Relative Path Traversal
7.1
CVE-2025-62688
AutomationDirect Productivity Suite Incorrect Permission Assignment for Critical Resource
