PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-22516 CODESYS CVE debrief

CVE-2022-22516 affects the SysDrv3S driver in the CODESYS Control runtime system on Microsoft Windows. According to the CISA-republished Festo advisory, a local system user can read and write within restricted memory space, which creates a high-risk integrity, confidentiality, and availability issue on affected hosts. The advisory ties the issue to Festo Automation Suite deployments that include CODESYS components. Festo notes that starting with Automation Suite version 2.8.0.138, CODESYS is no longer bundled and must be installed separately, which is part of the mitigation path.

Vendor
CODESYS
Product
FESTO
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-26
Original CVE updated
2026-03-17
Advisory published
2026-02-26
Advisory updated
2026-03-17

Who should care

OT/ICS administrators, controls engineers, and Windows workstation owners running Festo Automation Suite or CODESYS components, especially where local user accounts exist on engineering or control systems.

Technical summary

The vulnerability is a local-access memory protection issue in the SysDrv3S driver used by the CODESYS Control runtime on Windows. The advisory states that any system user can read and write restricted memory space, and the published CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high impact once a local user can reach the runtime.

Defensive priority

High — prioritize affected Windows OT/engineering hosts with local-user exposure.

Recommended defensive actions

  • Update Festo Automation Suite to version 2.8.0.138 or later where applicable.
  • Download the latest patched version of CODESYS directly from the official CODESYS website.
  • Follow the installation and update instructions provided by CODESYS so all security fixes are applied.
  • Monitor CODESYS security advisories and apply updates promptly.
  • Keep the Festo Automation Suite connector up to date by installing Festo-released updates.
  • Use CISA ICS recommended practices and defense-in-depth guidance for industrial control environments.

Evidence notes

CISA CSAF advisory ICSA-26-076-01 (republishing Festo SE & Co. KG FSA-202601) identifies the affected software as Festo Automation Suite with CODESYS Development System / CODESYS Control runtime components on Microsoft Windows. The issue is described as allowing any system user to read and write restricted memory space, and the supplied CVSS vector shows local access and privilege requirements with high impact. The prompt's vendor metadata is low-confidence, so the product/vendor mapping here follows the advisory body rather than the placeholder vendor label.

Official resources

CVE-2022-22516 was published on 2026-02-26 in CISA advisory ICSA-26-076-01 and modified on 2026-03-17 when CISA republished the initial Festo SE & Co. KG FSA-202601 advisory.