CVE-2026-67870 open62541 CVE debrief

Who should care

Organizations using open62541 v1.5.5, particularly those with exposed or internet-facing systems, should be aware of this critical vulnerability and take steps to mitigate or patch it. This includes operators of industrial control systems, SCADA systems, and other critical infrastructure. Vulnerability management and security teams should prioritize patching or mitigating the vulnerability to prevent potential remote attacks.

Technical summary

The server-side AddReferences implementation in open62541 v1.5.5 contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues. This could potentially allow for remote exploitation of the system. The vulnerability affects open62541 v1.5.5 and has a CVSS score of 9.8, indicating critical severity.

Defensive priority

Organizations using open62541 v1.5.5 should prioritize patching or mitigating the vulnerability to prevent potential remote attacks.

Recommended defensive actions

• Apply patches or updates for open62541 v1.5.5 as soon as available
• Implement compensating controls to monitor and restrict access to affected systems
• Conduct inventory checks to identify and prioritize affected systems
• Monitor for suspicious activity related to AddReferences requests
• Review and verify system logs for potential exploitation attempts
• Perform regular security audits to identify potential vulnerabilities
• Establish a process for rapid patching of critical vulnerabilities

Evidence notes

The CVE description indicates an incomplete validation flaw in open62541 v1.5.5's server-side AddReferences implementation. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues. The CVSS score is 9.8, indicating critical severity.

Official resources