Phoenix Contact PLCnext Engineer flaws allow full compromise before version 2026.6

CERT@VDE advisoriesPhoenix Contact, PLCnext Engineer

What happened. Phoenix Contact reports three flaws in PLCnext Engineer programming software: GSDX SignatureValue verification, signed plug-in validation bypass and path traversal. Effects may include a complete loss of confidentiality, integrity and availability. A second report covers the same advisory.

Who is affected. Users of Phoenix Contact PLCnext Engineer prior to version 2026.6, the programming software for PLCnext controllers.

What to do. Check whether you run PLCnext Engineer before 2026.6 and update to version 2026.6 or later.

When to act. Plan ahead: judged high and no score stated: check the vendor advisory

Editor's reading

Forasset ownerOT security lead

Purdue level: L3
L2
Level 3, site operations; Level 2, supervisory control (HMIs, SCADA, engineering workstations)
Why: PLCnext Engineer is programming software that runs on engineering workstations (L2) and configures controllers (L1).
Are you exposed?: Search your asset inventory and engineering workstations for PLCnext Engineer installations older than version 2026.6.
If you cannot fix it yet: Allow only trusted plug-ins and project files from known sources into engineering workstations.
Limit who can log on to engineering workstations and keep them off the corporate network and the internet.
Watch for: Look for PLCnext Engineer loading unexpected plug-ins or writing files outside its project folders.
Look for engineering workstations making unexpected downloads to controllers.
ATT&CK for ICS: T0843Program Download

Inferred from the facts above, not stated by the source. Check it against your own site before acting.

Source: CERT@VDE advisories (opens certvde.com)

More from this briefing

Read the full issue Executive report Get it by email