PatchSiren cyber security CVE debrief
CVE-2026-35063 OpenPLC_V3 CVE debrief
OpenPLC_V3 contains a broken access control vulnerability in its REST API. The endpoint validates JWT presence but fails to verify the caller's role, allowing any authenticated user with role=user to delete arbitrary users (including administrators) by user ID or create new accounts with role=admin, achieving full administrative access. The vulnerability was initially published on 2025-12-11 and updated on 2026-04-09. OpenPLC_v3 is now end-of-life; users should migrate to OpenPLC Runtime v4.
- Vendor
- OpenPLC_V3
- Product
- Unknown
- CVSS
- HIGH 8.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2025-12-11
- Original CVE updated
- 2026-04-09
- Advisory published
- 2025-12-11
- Advisory updated
- 2026-04-09
Who should care
Organizations operating OpenPLC_v3 in industrial control system environments, OT security teams, and asset owners managing programmable logic controller deployments.
Technical summary
The OpenPLC_V3 REST API endpoint performs JWT presence validation but omits role verification. An authenticated attacker with standard user privileges can manipulate user management endpoints to delete arbitrary accounts or create new administrative accounts, resulting in complete system compromise. The vulnerability is classified under CWE-862 (Missing Authorization).
Defensive priority
HIGH
Recommended defensive actions
- Migrate from OpenPLC_v3 to OpenPLC Runtime v4 as OpenPLC_v3 is end-of-life
- Implement network segmentation to restrict REST API access to authorized management hosts
- Review and audit all user accounts for unauthorized administrative privileges
- Apply principle of least privilege to API authentication and authorization layers
- Monitor API access logs for anomalous user creation or deletion events
Evidence notes
Vulnerability description and remediation guidance sourced from CISA CSAF advisory ICSA-25-345-10. CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirmed in source. CWE-862 (Missing Authorization) referenced in advisory.
Official resources
-
CVE-2026-35063 CVE record
CVE.org
-
CVE-2026-35063 NVD detail
NVD
-
Source item URL
cisa_csaf
-
Source reference
Reference
-
Source reference
Reference
-
Source reference
Reference
-
Source reference
Reference
-
Source reference
Reference
-
Source reference
Reference
-
Source reference
Reference
2025-12-11T07:00:00.000Z