PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-67870 open62541 CVE debrief

The CVE-2026-67870 record describes a critical vulnerability in open62541 v1.5.5. The server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues. Organizations using open62541 v1.5.5, particularly those with exposed or internet-facing systems, should be aware of this critical vulnerability and take steps to mitigate or patch it. The CVSS score is 9.8, indicating critical severity. The vulnerability affects open62541 v1.5.5 and may allow for remote exploitation of the system.

Vendor
open62541
Product
open62541
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-06
Original CVE updated
2026-08-31
Advisory published
2026-08-06
Advisory updated
2026-08-31

Who should care

Organizations using open62541 v1.5.5, particularly those with exposed or internet-facing systems, should be aware of this critical vulnerability and take steps to mitigate or patch it. This includes operators of industrial control systems, SCADA systems, and other critical infrastructure. Vulnerability management and security teams should prioritize patching or mitigating the vulnerability to prevent potential remote attacks.

Technical summary

The server-side AddReferences implementation in open62541 v1.5.5 contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues. This could potentially allow for remote exploitation of the system. The vulnerability affects open62541 v1.5.5 and has a CVSS score of 9.8, indicating critical severity.

Defensive priority

Organizations using open62541 v1.5.5 should prioritize patching or mitigating the vulnerability to prevent potential remote attacks.

Recommended defensive actions

  • Apply patches or updates for open62541 v1.5.5 as soon as available
  • Implement compensating controls to monitor and restrict access to affected systems
  • Conduct inventory checks to identify and prioritize affected systems
  • Monitor for suspicious activity related to AddReferences requests
  • Review and verify system logs for potential exploitation attempts
  • Perform regular security audits to identify potential vulnerabilities
  • Establish a process for rapid patching of critical vulnerabilities

Evidence notes

The CVE description indicates an incomplete validation flaw in open62541 v1.5.5's server-side AddReferences implementation. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues. The CVSS score is 9.8, indicating critical severity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-67870 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-67870

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-67870 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-67870

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.