CISA 2026-07-09

OpenPLC v3

CVE-2026-14480

Machine-generated analysis · WAYSCloud LLM

An authenticated attacker can write arbitrary files via a legacy web UI upload flaw, potentially leading to native code execution through the default compilation process.

Context

OpenPLC v3 is a programmable logic controller software used in critical manufacturing, energy, transportation, and water systems. The advisory states that an authenticated arbitrary file write vulnerability exists in the legacy web UI due to unsanitized user input in the program-upload workflow. This flaw allows attackers to write files to arbitrary paths, which can result in code execution by placing a malicious .cpp file in the runtime core directory. The default build process automatically compiles all C++ files in that directory, enabling escalation from file write to code execution.

Operator considerations

Check: Identify systems running OpenPLC v3, particularly those with the legacy web UI enabled.
Patch: Upgrade to OpenPLC v4, as OpenPLC v3 is end-of-life and no longer supported.
Log: Monitor authentication logs and file system changes in the OpenPLC runtime directory for suspicious activity.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability could allow an authenticated attacker to write arbitrary files to the filesystem and escalate this into arbitrary native code execution through the normal OpenPLC program compilation process, potentially resulting in code execution as the OpenPLC runtime user.

The following versions of OpenPLC v3 are affected:

OpenPLC v3

Vendor

Equipment

OpenPLC

OpenPLC v3

External Control of File Name or Path

Critical Infrastructure Sectors: Critical Manufacturing, Energy, Transportation Systems, Water and Wastewater

Countries/Areas Deployed: Worldwide

Company Headquarters Location: United States

OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attacker‑supplied filename (prog_file) directly into the Programs.File database field and later uses...

Read the full advisory on CISA →