Vendors and CVEs › Vendors › Phoenix Contact
Phoenix Contact: industrial cyber security news and vulnerabilities
3 stories in Industrial Cyber Brief name Phoenix Contact, from Wednesday 21 October 2026 to Thursday 5 November 2026. Newest first; each links the full story with who is affected and what to do.
The stories
High
Phoenix Contact PLCnext Engineer flaws allow full compromise before version 2026.6
Phoenix Contact reports three flaws in PLCnext Engineer programming software: GSDX SignatureValue verification, signed plug-in validation bypass and path traversal.
Low
Phoenix Contact software tools affected by CodeMeter Runtime licence flaws
Phoenix Contact lists multiple flaws in CodeMeter Runtime from Wibu-Systems, used for licence validation in its desktop software tools. They occur only with CodeMeter Runtime 8.x versions below 9.10.
Medium
OpenSSL flaws affect Festo AX OS in the CEPE product
Festo AX OS versions 25.0.1.46 and 25.9.2.4, used by the Festo CEPE and based on PLCnext, are affected by two OpenSSL flaws. Attacks involve crafted firmware, key files or signed objects.