PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-32142 CODESYS CVE debrief

CVE-2022-32142 is a high-severity memory-corruption issue in CODESYS products as packaged with Festo Automation Suite. A low-privileged remote attacker can send a request with an invalid offset and trigger an out-of-bounds read or write, which can lead to denial of service or local memory overwrite. The advisory states that no user interaction is required and recommends moving to patched CODESYS builds from the vendor and keeping Festo Automation Suite up to date.

Vendor
CODESYS
Product
FESTO
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-26
Original CVE updated
2026-03-17
Advisory published
2026-02-26
Advisory updated
2026-03-17

Who should care

OT/ICS teams using Festo Automation Suite, engineering workstations that include CODESYS components, plant administrators, patch-management teams, and incident responders supporting industrial automation environments.

Technical summary

The source advisory describes an invalid-offset handling flaw in multiple CODESYS product combinations distributed with Festo Automation Suite. The issue can cause out-of-bounds read or write access from a low-privileged remote request. Likely outcomes include service disruption and memory corruption, with the advisory also noting the possibility of local file changes. The advisory’s remediation guidance centers on using patched CODESYS from the official vendor and updating Festo Automation Suite as released.

Defensive priority

High. Prioritize inventorying Festo Automation Suite/CODESYS installations, verifying versions, and applying vendor updates because the issue is remotely reachable, requires only low privileges, and can affect availability and integrity.

Recommended defensive actions

  • Inventory all Festo Automation Suite installations and identify any bundled CODESYS components.
  • Check whether affected bundle combinations or versions listed in the advisory are present, especially installations below Festo Automation Suite 2.8.0.138.
  • Apply the latest patched CODESYS release from the official CODESYS website and follow the vendor’s installation/update instructions.
  • Update Festo Automation Suite with the latest connector or suite releases published by Festo.
  • Monitor CODESYS and Festo security advisories for follow-on fixes or version guidance.
  • Treat unexplained crashes or file-integrity changes on affected engineering systems as potential indicators of exploitation and investigate promptly.

Evidence notes

This debrief is based on CISA CSAF advisory ICSA-26-076-01, which republishes Festo SE & Co. KG advisory FSA-202601 for CVE-2022-32142. The source describes multiple affected Festo Automation Suite/CODESYS bundle combinations, states that user interaction is not required, and recommends obtaining patched CODESYS directly from the official vendor while keeping Festo updates current. The CVE and source advisory were published on 2026-02-26 and republished/modified by CISA on 2026-03-17.

Official resources

Publicly disclosed in CISA CSAF advisory ICSA-26-076-01 on 2026-02-26, with a CISA republication update on 2026-03-17. The supplied source uses 2026-02-26 as the CVE publication date; that date is used here for timing context.