PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-12390 AzeoTech CVE debrief

AzeoTech DAQFactory versions 21.1 and prior contain a Type Confusion vulnerability (CVSS Score: 8.4, CVSS Severity: HIGH) that can be exploited by an attacker using specially crafted .ctl files, potentially resulting in code execution. This vulnerability was published on June 18, 2026, and last modified on the same day. Organizations using affected versions of DAQFactory should take immediate action to mitigate this vulnerability. The vulnerability is tracked under CWE-843. A related advisory is available from CISA.

Vendor
AzeoTech
Product
DAQFactory
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-18
Original CVE updated
2026-06-25
Advisory published
2026-06-18
Advisory updated
2026-06-25

Who should care

Organizations using AzeoTech DAQFactory versions 21.1 and prior should be aware of this HIGH-severity vulnerability and take necessary actions to prevent potential code execution attacks.

Technical summary

The Type Confusion vulnerability in AzeoTech DAQFactory versions 21.1 and prior can be exploited through specially crafted .ctl files. This vulnerability has a CVSS Score of 8.4 and a CVSS Severity of HIGH. The vulnerability is classified under CWE-843. The attack vector is Local (AV:L), and the attack complexity is Low (AC:L).

Defensive priority

HIGH

Recommended defensive actions

  • Update AzeoTech DAQFactory to a version that is not vulnerable.
  • Implement proper input validation and sanitization for .ctl files.
  • Restrict access to .ctl files to authorized personnel only.
  • Monitor systems for suspicious activity related to DAQFactory.
  • Consider implementing additional security controls, such as intrusion detection and prevention systems.
  • Review and update incident response plans to address potential code execution attacks.
  • Refer to the CISA advisory for further guidance (see resource links).

Evidence notes

The information provided is based on data from the National Vulnerability Database (NVD) and the Common Vulnerability and Exposure (CVE) Program. The CVE record and NVD detail pages provide further information on this vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-12390 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-12390

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-12390 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-12390

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.