o6 Automation open62541 OPC UA Flaws Patched
CISA warns of four vulnerabilities in o6 Automation's open62541 OPC UA stack that could enable DoS, information disclosure, or remote code execution.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA published an ICS advisory detailing four vulnerabilities in open62541, an open-source OPC UA implementation used by o6 Automation GmbH (Germany) across Windows and Linux deployments in critical manufacturing, energy, and transportation sectors worldwide. The flaws span multiple versions from 1.3.0 through 1.5.4 and the master branch, and include an integer underflow in PubSub signature verification (CVE-2026-63362) that can cause denial of service via crafted UDP packets, two integer overflow issues in UA_Variant arrayDimensions computation (CVE-2026-65423 and CVE-2026-63559) leading to out-of-bounds write and out-of-bounds heap read respectively, and a heap use-after-free in the TransferSubscriptions service (CVE-2026-63035) that could allow an authenticated attacker to cause DoS or potentially execute arbitrary code.
The vendor has prepared fixes referenced in open62541 GitHub pull requests and security advisories SA-2026-0012, SA-2026-0014, and SA-2026-0015, and recommends organizations update to the latest version or contact o6 Automation directly. CISA notes no known public exploitation targeting these vulnerabilities at this time, and recommends standard ICS defensive measures including network isolation, firewalling control system networks, and secure remote access via VPN. The vulnerabilities were reported to CISA by researchers Asher Davila (Palo Alto Networks) and Abhinav Agarwal.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-08
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs