PatchSiren cyber security CVE debrief
CVE-2026-66360 MZ Automation GmbH CVE debrief
A vulnerability in the ISO Presentation layer allows an attacker to trigger a denial of service condition via a crafted TCP/102 connection attempt, causing a process termination due to a bounded heap overread. This issue arises from a missing length check in the processing of encoded presentation data, allowing an attacker-controlled field with a zero-length value to trigger the overread before MMS session establishment. Organizations should verify and apply vendor remediation to prevent potential denial of service conditions. Affected operators, platforms, vulnerability-management, and security teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
- Vendor
- MZ Automation GmbH
- Product
- libiec61850
- CVSS
- HIGH 8.7
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-30
- Original CVE updated
- 2026-07-31
- Advisory published
- 2026-07-30
- Advisory updated
- 2026-07-31
Who should care
Organizations using affected systems should verify and apply vendor remediation to prevent potential denial of service conditions. Affected operators, platforms, vulnerability-management, and security teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
Technical summary
The ISO Presentation layer contains a flaw in handling specific parameters during normal mode negotiation, allowing an attacker-controlled field with a zero-length value to trigger a bounded heap overread, causing a denial of service condition. This occurs before MMS session establishment, and a crafted TCP/102 connection attempt can trigger the issue. The resulting overread causes the process to terminate, leading to a denial of service condition. Affected product context indicates that defensive impact is high, and source-grounded technical framing suggests that further verification is needed to confirm affected scope and severity.
Defensive priority
High priority due to potential for denial of service
Recommended defensive actions
- Verify and apply vendor remediation
- Implement compensating controls
- Monitor for suspicious activity
- Perform inventory checks
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
Evidence notes
Evidence from official CVE and NVD sources indicates a flaw in ISO Presentation layer handling specific parameters, allowing for a denial of service condition. The issue arises from a missing length check in the processing of encoded presentation data, which can be triggered by a crafted TCP/102 connection attempt. This results in a bounded heap overread, causing the process to terminate. Affected systems should verify and apply vendor remediation to prevent potential denial of service conditions. Evidence limits suggest that further verification is needed to confirm affected scope and severity.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-30T23:16:53.070Z and has not been modified since then.