CVE-2026-2364

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

If a legitimate user confirms a self-update prompt or initiate an installation of a CODESYS Development System, a low privileged local attacker can gain elevated rights due to a TOCTOU vulnerability in the CODESYS installer.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-367

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Mar 10, 2026
Last modified: Jun 17, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-236435.4CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via qu CVE-2026-236447.5esm.sh is a no-build content delivery network (CDN) for web development. Prior to Go pseeudoversion 0.0.0-20260116051925-c62ab83c589e, the s CVE-2026-236456.1SiYuan is self-hosted, open source personal knowledge management software. Prior to 3.5.4-dev2, a Stored Cross-Site Scripting (XSS) vulnerab CVE-2026-236466.5OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and 17.0.1 have the abil CVE-2026-236479.8Glory RBG-100 recycler systems using the ISPK-08 software component contain hard-coded operating system credentials that allow remote authen CVE-2026-236487.8Glory RBG-100 recycler systems using the ISPK-08 software component contain multiple system binaries with overly permissive file permissions CVE-2026-23657.2The Fluent Forms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `fluentform_step_form_save_data` AJAX action CVE-2026-236516.7Permissive regular expression in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.CVE-2026-236529.8Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an unauthorized attacker CVE-2026-236536.5Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an autho CVE-2026-236548.8Dependency on vulnerable third-party component in GitHub Repo: zero-shot-scfoundation allows an unauthorized attacker to execute code over a CVE-2026-236556.5Cleartext storage of sensitive information in Azure Compute Gallery allows an authorized attacker to disclose information over a network.