OpenPLC Web Flaw Could Turn a Stolen Session into Industrial Process Control

A cross-site scripting vulnerability in Autonomy Logic’s OpenPLC Runtime v3 could let attackers hijack operator sessions, change controller state, and potentially manipulate physical processes.

CISA published its initial advisory on September 22, 2026. The vulnerability, tracked as CVE-2026-88020, affects the product listing OpenPLC 3, v3 6.1 and is classified as medium severity.

No vendor patch or updated release has been identified. CISA also said it had received no reports of public exploitation specifically targeting this vulnerability.

Unencoded input reaches the OpenPLC web interface

CVE-2026-88020 is categorized as CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as cross-site scripting.

The flaw occurs when the OpenPLC web interface uses an unencoded query-string parameter to route a program. Because the parameter is not adequately neutralized, attacker-controlled content can be interpreted by the interface rather than handled strictly as data.

This creates a path for malicious web content to execute in the context of an authenticated operator’s browser session. The attacker does not need an existing OpenPLC account, but exploitation requires the targeted user to interact with the malicious content.

The primary objective would be theft of the operator’s session cookie. Once that session is compromised, the attacker could send state-changing requests while appearing to the OpenPLC application as the legitimate user.

That distinction matters in an industrial environment. The exposure is not limited to manipulating a web page or accessing account information. If the hijacked session has sufficient permissions, the attacker could modify PLC state and influence the equipment or process connected to it.

The vulnerability was reported to CISA by Rajivarnan R. and Shirshak of Secnora.

Medium scoring masks a potentially physical consequence

CISA assigned CVE-2026-88020 a CVSS 3.1 score of 6.1, rated Medium:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The vector describes a network-reachable attack with low attack complexity and no privileges required. However, user interaction is necessary. The listed impact is limited to confidentiality and integrity, with no direct availability impact represented in the score.

Under CVSS 4.0, the vulnerability received a 5.3 Medium rating:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

This assessment similarly indicates that an attacker can reach the vulnerable component over a network without prior authorization, but must obtain user participation. It records limited confidentiality and integrity effects across both the vulnerable system and subsequent systems, without a scored availability effect.

The CVSS 3.1 vector includes a changed scope. In practical terms, successful exploitation can cross the security boundary of the vulnerable web application: injected content may compromise an operator’s authenticated session and then affect the controller managed through that interface.

A medium numerical rating therefore does not define the full operational risk. The eventual consequence depends on the operator’s privileges, the PLC configuration, and the physical process under control.

Affected deployments span multiple critical sectors

The affected product is Autonomy Logic OpenPLC Runtime v3, with the known-affected entry listed as OpenPLC 3, v3 6.1. Deployment is worldwide, and the vendor is headquartered in the United States.

CISA associates the product with several critical infrastructure sectors:

• Critical Manufacturing
• Energy
• Transportation Systems
• Water and Wastewater Systems

An attacker who compromises an authenticated session could act with the operator’s authority, submit requests that modify system state, and potentially control the affected PLC. The resulting impact would vary substantially between installations.

In a laboratory or isolated test environment, the consequences may remain limited to the controller. In an operational deployment, unauthorized PLC changes could alter the physical process attached to it. No specific process disruption, affected organization, or confirmed intrusion has been reported for this flaw.

CISA classified the vulnerability as medium severity under both scoring systems and reported no known public exploitation targeting it at the time of publication. No CISA Known Exploited Vulnerabilities catalog entry, remediation deadline, or ransomware-use designation is identified for CVE-2026-88020.

No vendor patch has been identified

The available information does not identify a vendor-provided patch, fixed version, or software update. Organizations should first inventory their OpenPLC installations and determine whether OpenPLC 3, v3 6.1 is present.

Until a corrected release is available, defenders should reduce access to the OpenPLC web interface. It should not be directly reachable from the public internet, and access should be limited to authorized administrative systems and users.

CISA’s industrial control systems advisory recommends placing control-system networks and remote devices behind firewalls, with separation from business networks. This reduces the number of users and systems capable of reaching the vulnerable interface.

Where remote access is operationally necessary, organizations should use secured access paths such as VPNs. Those VPN products and the endpoints connecting through them must also be kept current, since remote-access infrastructure can introduce separate vulnerabilities.

Any network or access-control change should undergo an operational impact assessment before deployment. Industrial environments may have availability, timing, and safety constraints that make untested defensive changes disruptive.

What defenders should monitor now

CISA has not published vulnerability-specific indicators of compromise. Defenders must therefore focus on behavior around the OpenPLC web interface, authenticated sessions, and controller changes.

Useful monitoring priorities include:

• Unexpected or malformed query-string parameters reaching the OpenPLC interface.
• Unusual requests associated with program-routing functions.
• Authenticated actions originating from unfamiliar systems or network locations.
• Reuse of an operator session from multiple hosts.
• State-changing requests that do not match approved maintenance activity.
• Unauthorized PLC configuration or logic changes.
• Process changes that cannot be linked to an authorized operator action.

Administrators should invalidate suspicious sessions and review whether operator credentials or browser sessions may have been exposed. Access logs, reverse-proxy records, firewall telemetry, and controller change histories may help establish whether unusual requests led to privileged activity.

Operators should also be cautious with unsolicited messages, links, and attachments. Because exploitation requires user participation, phishing or another social-engineering method could be used to bring an authenticated operator into contact with attacker-controlled content.

Organizations that observe suspected malicious activity should follow their incident-response procedures and report it to CISA. Reporting can help correlate isolated events across industrial environments, particularly while no public exploitation campaign has been confirmed.

For now, the central defensive measures are exposure reduction, segmentation, strict control of remote access, session monitoring, and verification of every consequential PLC change.