CVE-2026-3509: CODESYS Control Audit Log Format String DoS

Published Mar 24, 2026

Updated

An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log of the CODESYS Control runtime system, potentially resulting in a denial‑of‑service (DoS) condition.

Affected Software

1 affected component

CODESYS CODESYS Control

Event History

Mar 24, 2026

CVE Published

via MITRE·07:42 AM

Data Sourced

via MITRE·07:42 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:16 AM

DescriptionSeverityWeakness

Sep 5, 58213

Event

via FIRST·02:15 PM

Frequently Asked Questions

What is the severity of CVE-2026-3509?

CVE-2026-3509 has a high severity rating due to its potential to allow an unauthenticated remote attacker to cause a denial-of-service condition.

How do I fix CVE-2026-3509?

To mitigate CVE-2026-3509, ensure that you apply the latest updates and patches from CODESYS for the Control runtime system.

What systems are affected by CVE-2026-3509?

CVE-2026-3509 affects the CODESYS Control runtime system, particularly related to its audit log feature.

Is authentication required to exploit CVE-2026-3509?

No, CVE-2026-3509 can be exploited by an unauthenticated remote attacker.

What impact does CVE-2026-3509 have on operations?

CVE-2026-3509 can lead to a denial-of-service condition, disrupting the functionalities of the affected systems.