PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-22516 CODESYS CVE debrief

CVE-2022-22516 affects the SysDrv3S driver in the CODESYS Control runtime system on Microsoft Windows. According to the CISA-republished Festo advisory, a local system user can read and write within restricted memory space, which creates a high-risk integrity, confidentiality, and availability issue on affected hosts. The advisory ties the issue to Festo Automation Suite deployments that include CODESYS components. Festo notes that starting with Automation Suite version 2.8.0.138, CODESYS is no longer bundled and must be installed separately, which is part of the mitigation path.

Vendor
CODESYS
Product
FESTO
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-26
Original CVE updated
2026-03-17
Advisory published
2026-02-26
Advisory updated
2026-03-17

Who should care

OT/ICS administrators, controls engineers, and Windows workstation owners running Festo Automation Suite or CODESYS components, especially where local user accounts exist on engineering or control systems.

Technical summary

The vulnerability is a local-access memory protection issue in the SysDrv3S driver used by the CODESYS Control runtime on Windows. The advisory states that any system user can read and write restricted memory space, and the published CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high impact once a local user can reach the runtime.

Defensive priority

High — prioritize affected Windows OT/engineering hosts with local-user exposure.

Recommended defensive actions

  • Update Festo Automation Suite to version 2.8.0.138 or later where applicable.
  • Download the latest patched version of CODESYS directly from the official CODESYS website.
  • Follow the installation and update instructions provided by CODESYS so all security fixes are applied.
  • Monitor CODESYS security advisories and apply updates promptly.
  • Keep the Festo Automation Suite connector up to date by installing Festo-released updates.
  • Use CISA ICS recommended practices and defense-in-depth guidance for industrial control environments.

Evidence notes

CISA CSAF advisory ICSA-26-076-01 (republishing Festo SE & Co. KG FSA-202601) identifies the affected software as Festo Automation Suite with CODESYS Development System / CODESYS Control runtime components on Microsoft Windows. The issue is described as allowing any system user to read and write restricted memory space, and the supplied CVSS vector shows local access and privilege requirements with high impact. The prompt's vendor metadata is low-confidence, so the product/vendor mapping here follows the advisory body rather than the placeholder vendor label.

Sources and references

Verified primary and authoritative sources

  • CVE-2022-22516 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2022-22516

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2022-22516 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2022-22516

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-076-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://certvde.com/en/advisories/vendor/festo/

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.festo.com/psirt

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://certvde.com/en/advisories/VDE-2025-108

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cve.org/CVERecord?id=CVE-2025-2595

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-076-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.