ABB Edgenius patches Linux kernel privilege escalation flaw
A Linux kernel crypto subsystem flaw (CVE-2026-31431) lets a local user or compromised container escalate to root on ABB Ability Edgenius edge devices; a fix is available.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-31431 as exploited in the wild.
ABB has disclosed CVE-2026-31431, a Linux kernel vulnerability in the algif_aead cryptographic algorithm interface affecting ABB Ability Edgenius, an edge computing platform used to connect control systems and host operational data applications in critical manufacturing, energy, water/wastewater, and chemical sectors worldwide. The flaw stems from an incorrect in-place operation where source and destination data mappings differ, leading to memory handling issues that a locally authenticated user or compromised container workload can exploit to escalate privileges to root, gaining complete control of the affected system node.
Exploitation requires local access—either physical access or valid SSH/Cockpit credentials—and cannot be performed remotely. The risk is elevated in shared, containerized, or multi-tenant environments where an attacker may already have limited local access. ABB Ability Edgenius versions >=3.2.0.0 and <3.2.4.1 running on Edgenius Gateway - bE100 are affected; version 3.2.4.1 resolves the issue by incorporating the upstream Linux kernel security fix. The vulnerability affects Linux kernels used by most major distributions released since 2017, making it broadly relevant beyond this specific product.
The vulnerability has been publicly disclosed but ABB has not received reports of active exploitation against Edgenius at the time of publication. Recommended mitigations include applying the vendor update at earliest convenience, limiting access to SSH or Cockpit interfaces, minimizing network exposure of control system devices, isolating ICS networks behind firewalls, and using VPNs for any required remote access. By default, Edgenius installations do not include additional lower-privilege users, which somewhat limits the local attack surface.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-06
Free public brief. The indicators are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs