CVE-2026-88020

Medium6.1Published on September 22, 2026

Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding.

CVSS score6.1 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness type (CWE)CWE-79

Vulnerabilities

OpenPLC Web Flaw Could Turn a Stolen Session into Industrial Process Control

CVE-2026-88020 XSS in OpenPLC Runtime v3 lets attackers hijack operator sessions and alter PLC state. No patch yet; CISA urges network isolation.

Sep 23, 202611:545 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Related articles

OpenPLC Web Flaw Could Turn a Stolen Session into Industrial Process Control