1. Executive summary
CISA published ICS advisory ICSA-26-265-09 on 2026-09-22 covering CVE-2026-88020, a cross-site scripting vulnerability (CWE-79) in Autonomy Logic OpenPLC Runtime v3. The flaw sits in the product's web interface, which routes the program based on a query string parameter with no encoding. Successful exploitation lets an attacker hijack an operator's session cookies and issue state-changing requests as that operator, which in turn gives control of the programmable logic controller and the physical processes it drives. CVSS v3.1 is 6.1 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N); CVSS v4.0 is 5.3 MEDIUM. CISA states no known public exploitation targeting this vulnerability has been reported at this time, and the CVE is not on the CISA KEV list. OpenPLC v3 is end-of-life with no patches forthcoming; the only vendor fix is migration to OpenPLC v4. Direct exposure of EMEA financial services institutions is likely limited to facilities management, building automation and physical security systems rather than core banking platforms, but any internet-reachable OpenPLC v3 web interface is an immediate finding.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item. The advisory describes a vulnerability in an end-of-life industrial control product with no reported exploitation and no incident; the generic fact that patching may be required does not on its own trigger the articles in the provided reference. Institutions that identify OpenPLC v3 in their OT estate during triage should treat that discovery as an input to their existing ICT risk processes, but no reporting or testing obligation specific to this advisory follows from the reference material.
3. Technical analysis & attack chain
CVE-2026-88020 is an improper neutralization of input during web page generation flaw (CWE-79) in Autonomy Logic OpenPLC Runtime v3. The web interface attempts to route the program based on a query string parameter, and that parameter is handled with no encoding. An attacker who can deliver a crafted link to an authenticated operator can inject script that executes in the operator's browser session against the OpenPLC web application.
Confirmed chain, as far as the advisory supports it:
- The attacker identifies a reachable OpenPLC v3 web interface and an operator with an authenticated session.
- The attacker crafts a URL whose query string parameter, used by the web interface for program routing, carries unencoded attacker-controlled input, and induces the operator to follow it (the CVSS vector requires user interaction: UI:R in v3.1, UI:P in v4.0).
- The injected script executes in the operator's browser in the context of the OpenPLC web application.
- The attacker hijacks the operator's session cookies.
- Using the stolen session, the attacker issues state-changing requests as the operator and controls the PLC and the physical processes it drives.
The scope is unchanged in the v3.1 vector (S:C), which is what makes a browser-side flaw consequential for the control system: the impact crosses from the web application into the operational technology it manages. Confidentiality and integrity are both rated low in the metrics; availability is rated as not affected (A:N in v3.1, VA:N in v4.0), so the advisory does not support claims of process shutdown or denial of service. The concrete risk is unauthorised state change on the controller.
Two caveats on scope. First, the advisory names only "OpenPLC Runtime v3" and "Autonomy Logic OpenPLC: 3" as affected, with no enumerated point releases, so treat the entire v3 line as affected. Second, the advisory does not specify which query string parameter is vulnerable, whether exploitation requires the operator to be on the OT network or merely to have an active session, or any payload detail beyond session hijacking; those specifics are absent from the source and should not be assumed. CISA lists Critical Manufacturing, Energy, Transportation Systems, and Water and Wastewater Systems as critical infrastructure sectors, with worldwide deployment. The vulnerability was reported to CISA by Rajivarnan R. and Shirshak of Secnora. No threat actor attribution is claimed by any source, and none should be inferred.
4. Mitigation & containment
P1, within 24 hours:
- Inventory the OT, facilities and building-management estates for OpenPLC Runtime v3 web interfaces. The default OpenPLC web server listens on TCP port 8080; confirm actual ports per deployment rather than assuming the default.
- Block all inbound access to OpenPLC web interfaces from the internet and from general corporate networks at the firewall. Only engineering workstations on a segmented control network should reach them.
- If an OpenPLC v3 instance must remain reachable to a defined user group, restrict it to an allowlist of source addresses and place it behind an authenticated VPN gateway, per CISA's recommended practices, and keep the VPN itself current.
P2, within 72 hours:
- Plan the migration to OpenPLC v4. This is the only vendor fix; OpenPLC v3 is end-of-life and receives no patches, bug fixes or security updates, so there is no in-place remediation for CVE-2026-88020.
- Review web server and application logs on exposed instances for anomalous query strings on program-routing requests and for session activity inconsistent with operator working patterns. The advisory reports no known exploitation, so this is a hygiene check, not an incident response.
- Where migration cannot be scheduled quickly, document the residual risk and apply compensating controls: network isolation, session timeout reduction if the deployment supports it, and operator briefings against following unsolicited links while authenticated to the interface.
P3, within 7 days:
- Add OpenPLC v3 to the end-of-life register and include it in the next architecture review of the OT estate.
- Confirm that control system networks remain separated from business networks, per CISA's defence-in-depth guidance, and that any remote access to the OT estate uses current VPN versions.
5. Indicators of compromise
No indicators of compromise available in the source material. The advisory describes a vulnerability and its potential impact; it reports no exploitation, no observed intrusions and no attacker artefacts.
6. Detection
Insufficient indicators to author detection rules. The advisory names no vulnerable parameter, no payload strings, no file paths and no behavioural signatures. A rule built from the CVE identifier or the product name would detect reporting about the vulnerability, not exploitation of it.
7. Sources
- CISA, OpenPLC Runtime v3, ICSA-26-265-09, https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-09, 2026-09-22
8. Adverse Trace position
We assess this as a medium-severity vulnerability with low likelihood of targeted use against financial services institutions in the near term: the CVSS scores are 6.1 MEDIUM (v3.1) and 5.3 MEDIUM (v4.0), the CVE is not on CISA KEV, and CISA reports no known public exploitation. The impact is nonetheless physical rather than purely informational, since a hijacked operator session extends to control of the PLC and the processes it drives, and the end-of-life status of v3 means the exposure is permanent until migration. Clients with facilities-management or building-automation estates should complete the P1 inventory within 24 hours and treat any internet-reachable OpenPLC v3 interface as an urgent finding regardless of sector. The vulnerability detail is single-sourced, resting entirely on the CISA advisory and the coordinated disclosure by Secnora's researchers; no second-party technical analysis was available at publication. We will monitor for KEV listing, proof-of-concept publication and any follow-on analysis, and will reissue this advisory if exploitation is reported.
Published via PulseTrace — Adverse Trace threat intelligence.