PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44468 CODESYS CVE debrief

CVE-2026-44468 is a high-severity local privilege escalation vulnerability disclosed on 2026-05-26. The issue stems from insecure default directory permissions created during administrative installation of an affected product. A low-privileged local attacker can exploit this by modifying a temporary file that defines installation components, thereby forcing the deployment of arbitrary components and achieving privilege escalation. The vulnerability is classified under CWE-276 (Incorrect Default Permissions) and carries a CVSS 4.0 vector indicating high impacts to confidentiality, integrity, and availability when exploited locally with low attack complexity and low privileges required. The vendor attribution remains uncertain—evidence points to Certvde as a reference domain candidate, but confidence is low and the finding requires review. No known exploitation in ransomware campaigns has been documented, and the vulnerability is not listed in CISA KEV. Organizations should prioritize reviewing installation procedures for products that create temporary directories during privileged operations, ensure restrictive permissions on installation staging areas, and monitor for unauthorized modifications to component manifests during software deployment.

Vendor
CODESYS
Product
CODESYS Development System
CVSS
HIGH 8.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-05-26
Advisory published
2026-05-26
Advisory updated
2026-05-26

Who should care

System administrators responsible for software deployment, security teams managing endpoint privilege escalation risks, and organizations with strict least-privilege requirements should prioritize assessment. The vulnerability is particularly relevant in multi-user environments where low-privileged users share systems with administrative software installation processes.

Technical summary

The vulnerability exists when an installer creates a directory with insecure default permissions (world-writable or overly permissive) during administrative installation. A low-privileged attacker with local access can modify a temporary file that specifies which components to install. By altering this component manifest, the attacker can force the installer to deploy arbitrary or malicious components with elevated privileges, resulting in local privilege escalation. The attack requires local access, low privileges, and no user interaction, with high impact to confidentiality, integrity, and availability of the affected system.

Defensive priority

high

Recommended defensive actions

  • Review software deployment procedures to identify products creating temporary directories with overly permissive defaults during administrative installation
  • Apply restrictive permissions (e.g., 0700 or equivalent) to installation staging directories and temporary file locations used by privileged installers
  • Implement integrity monitoring for component manifest files and installation configuration data during software deployment workflows
  • Audit local user accounts with access to installation directories and apply principle of least privilege for software deployment operations
  • Monitor for anomalous file modifications in installation staging areas, particularly changes to component definition files by non-privileged users

Evidence notes

Vulnerability description and CVSS vector sourced from NVD record. Vendor attribution marked low confidence based on reference domain candidate 'Certvde' from advisory source. No KEV entry or ransomware use documented. CWE-276 classification provided by cert.vde.com reference.

Official resources

2026-05-26