CVE-2021-21864 Unknown Vendor CVE debrief

Who should care

Organizations running Festo Automation Suite or affected CODESYS Development System installations, especially OT, engineering, and automation teams that exchange project files, import configurations, or rely on vendor-supplied packages on shared workstations.

Technical summary

The advisory describes an unsafe deserialization weakness in ComponentModel ComponentManager.StartupCultureSettings. The provided CVSS vector indicates local attack conditions, low complexity, no privileges required, and user interaction required, with high confidentiality, integrity, and availability impact. The documented outcome is arbitrary command execution when a specially crafted file is processed.

Defensive priority

High for systems that handle supplier files, project imports, or other untrusted inputs; moderate for tightly isolated installations that never process external files, but still important because the impact is code execution.

Recommended defensive actions

• Upgrade to the latest patched CODESYS release from official CODESYS channels and follow the vendor's installation guidance.
• If using Festo Automation Suite, install the FAS updates released by Festo; the advisory states that starting with version 2.8.0.138, CODESYS is no longer bundled and must be installed separately.
• Treat project and configuration files as potentially hostile and restrict receipt of untrusted files on engineering workstations.
• Monitor CODESYS and Festo security advisories and apply updates promptly.
• Verify that affected CODESYS versions 3.5.16 and 3.5.17 are not present in deployed environments, including externally installed components.

Evidence notes

The source corpus contains a CISA CSAF advisory (ICSA-26-076-01) republished from Festo's advisory. Its revision history shows an initial release on 2026-02-26 and a republication on 2026-03-17. The advisory text names CODESYS Development System 3.5.16 and 3.5.17 and states that a specially crafted file can cause arbitrary command execution. The vendor metadata supplied with the prompt is inconsistent with the advisory text; the evidence links this issue to Festo Automation Suite packaging and CODESYS, so the product attribution should be reviewed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.