CVE-2026-35226: CODESYS PROFINET Controller DoS Vulnerability

CVE-2026-35226 Overview

CVE-2026-35226 is an out-of-bounds write vulnerability [CWE-787] in the CODESYS PROFINET Controller. An unauthenticated attacker on the same network segment can send malformed PROFINET communication data to trigger an exception in the affected Programmable Logic Controller (PLC) application. The CODESYS Control runtime system handles the exception and forces a controlled stop of the PLC application, resulting in a denial-of-service condition against industrial control processes.

Critical Impact
An adjacent-network attacker can halt PLC operations by sending crafted PROFINET traffic, disrupting industrial automation processes that depend on the affected controller.

Affected Products

CODESYS PROFINET Controller
CODESYS Control runtime system (as the runtime handling the exception)
PLC applications built on the CODESYS Control platform

Discovery Timeline

2026-07-29 - CVE-2026-35226 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-35226

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] within the PROFINET Controller component of CODESYS. PROFINET is an industrial Ethernet protocol used for real-time data exchange between controllers and field devices. The controller component parses incoming PROFINET frames and writes data into memory buffers during processing.

When a malformed PROFINET frame reaches the controller, the parsing logic writes beyond the intended buffer boundary. The write triggers a memory access violation. The CODESYS Control runtime system catches the resulting exception and stops the PLC application in a controlled manner rather than allowing undefined behavior to continue. The attack requires only network adjacency, not authentication or user interaction.

Root Cause

The root cause is missing or insufficient bounds checking during PROFINET frame parsing inside the CODESYS PROFINET Controller. Input fields within the malformed PROFINET communication data drive a memory write operation that exceeds the target buffer's allocated size. The runtime does not prevent the out-of-bounds write itself; it only catches the fault after it occurs and halts the application.

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must be present on the same Layer 2 network segment as the target PLC. The attacker crafts malformed PROFINET frames and transmits them to the controller. No credentials, prior access, or user interaction are required. Successful delivery of the crafted frame causes the PLC application to enter a controlled stop, breaking availability of the industrial process the controller manages. Confidentiality and integrity are not directly impacted.

See the CERT-VDE Advisory VDE-2026-041 for vendor-provided technical details.

Detection Methods for CVE-2026-35226

Indicators of Compromise

Unexpected PLC application stops or transitions to a stopped state reported by the CODESYS Control runtime.
Runtime exception log entries in the CODESYS Control system referencing the PROFINET Controller component.
Malformed or non-conformant PROFINET frames observed on the operational technology (OT) network segment hosting the controller.

Detection Strategies

Deploy OT-aware network monitoring that performs deep packet inspection of PROFINET traffic and flags protocol violations or malformed frame structures.
Correlate PLC state-change events (run to stop) with concurrent network anomalies on the PROFINET segment.
Baseline normal PROFINET communication patterns between the controller and known field devices, and alert on frames originating from unexpected MAC addresses.

Monitoring Recommendations

Forward CODESYS Control runtime diagnostic logs to a central logging platform for correlation with network telemetry.
Monitor Layer 2 segments for unauthorized devices attaching to the PROFINET network.
Track PLC availability metrics and alert on unplanned application stops that align with anomalous traffic.

How to Mitigate CVE-2026-35226

Immediate Actions Required

Identify all deployments of the CODESYS PROFINET Controller in the environment and inventory affected PLC applications.
Restrict PROFINET network segments to authorized devices only, using strict Layer 2 segmentation and port security.
Apply the fixed CODESYS versions as identified in the CERT-VDE Advisory VDE-2026-041 once available in your maintenance window.

Patch Information

Refer to the CERT-VDE Advisory VDE-2026-041 for the authoritative list of fixed versions and vendor remediation guidance. Coordinate patch deployment with process owners because updating PLC runtimes typically requires controlled downtime.

Workarounds

Isolate PROFINET traffic on dedicated VLANs or physically separate networks, and block PROFINET frames at boundaries to enterprise or remote-access networks.
Enforce access control on switch ports connected to the PROFINET segment using MAC filtering or 802.1X where supported by the OT infrastructure.
Deploy an OT-focused intrusion detection system inline or as a passive sensor to alert on malformed PROFINET frames targeting the controller.
Maintain tested procedures for rapidly restarting stopped PLC applications to minimize process disruption if exploitation occurs.

bash

# Configuration example: restrict PROFINET segment access at the switch
# (Cisco-style CLI, adapt to your OT switch vendor)
interface GigabitEthernet0/5
 description PROFINET-Controller-Uplink
 switchport mode access
 switchport access vlan 200
 switchport port-security
 switchport port-security maximum 1
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 storm-control broadcast level 1.00
 spanning-tree bpduguard enable