CVE-2026-35227: CODESYS Modbus TCP Server DoS Vulnerability

CVE-2026-35227 Overview

CVE-2026-35227 affects the CODESYS Modbus TCP Server stack. An unauthenticated remote attacker can exhaust all available TCP connections by exploiting a race condition in connection handling. Successful exploitation prevents legitimate Modbus clients from establishing new sessions with the server. The flaw is categorized under [CWE-772] Missing Release of Resource After Effective Lifetime. The vulnerability requires no authentication and no user interaction, and it is reachable over the network. Industrial environments running CODESYS-based controllers are most exposed, since Modbus TCP is a primary protocol for programmable logic controller (PLC) communication on operational technology (OT) networks.

Critical Impact

Remote, unauthenticated denial of service against industrial control systems using the CODESYS Modbus TCP Server, blocking new client connections and disrupting OT operations.

Affected Products

• CODESYS Modbus TCP Server stack (see CERT@VDE advisory VDE-2026-042 for versions)
• CODESYS-based programmable logic controller (PLC) runtimes exposing Modbus TCP
• Industrial devices integrating the affected CODESYS Modbus TCP Server component

Discovery Timeline

• 2026-05-12 - CVE CVE-2026-35227 published to NVD
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-35227

Vulnerability Analysis

The vulnerability is a race condition in the connection-handling logic of the CODESYS Modbus TCP Server. When concurrent connection attempts arrive at the server, the code path that tracks active sessions and releases resources for closed or aborted connections does not synchronize correctly. Attackers can repeatedly trigger this race to leak connection slots until the server's pool is fully consumed.

Once the pool is exhausted, the server stops accepting new TCP sessions. Legitimate engineering workstations, supervisory control and data acquisition (SCADA) clients, and human-machine interfaces (HMIs) lose the ability to read or write Modbus registers. The condition persists until the server is restarted or the leaked connections time out internally.

The vulnerability impacts availability only. Confidentiality and integrity of process data are not directly affected, and the attacker does not gain code execution or read access to control logic. However, loss of Modbus availability in an industrial setting can interrupt monitoring and control loops.

Root Cause

The root cause is improper release of a connection resource after its effective lifetime, mapped to [CWE-772]. The handler does not atomically transition socket state and free the slot, allowing concurrent requests to bypass cleanup. This is a classic race condition resulting in resource exhaustion.

Attack Vector

An attacker on the network sends rapid, concurrent TCP connection attempts to the Modbus TCP port, typically TCP/502. By racing connection establishment and teardown, the attacker causes connection slots to remain allocated. Repeating this pattern exhausts the server's connection table. No credentials, user interaction, or prior foothold are required. The attack is network-reachable wherever the Modbus TCP Server is exposed.

No public proof-of-concept exploit is currently listed in the enriched data, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. Refer to the CERT@VDE Security Advisory VDE-2026-042 for vendor-specific technical details.

Detection Methods for CVE-2026-35227

Indicators of Compromise

• High volume of short-lived or half-open TCP connections to port 502 from a single source or a small set of sources.
• Sudden inability of HMI, SCADA, or engineering workstation clients to connect to a CODESYS Modbus TCP Server while the device itself remains reachable on other ports.
• Connection table or socket allocation metrics on the controller reaching maximum capacity without corresponding legitimate workload growth.

Detection Strategies

• Monitor TCP/502 for connection rate anomalies and SYN/FIN imbalances using network detection and response (NDR) or industrial intrusion detection system (IDS) sensors.
• Correlate Modbus client disconnect events with spikes in new connection attempts to the same destination to identify exhaustion patterns.
• Apply behavioral baselines per controller, since Modbus traffic is typically low-rate and predictable in OT environments.

Monitoring Recommendations

• Forward firewall, switch, and PLC connection logs to a centralized data lake for cross-source correlation.
• Alert on sustained connection counts to TCP/502 exceeding the controller's documented session limit.
• Track availability of Modbus polling cycles from HMI and SCADA hosts to detect operational impact early.

How to Mitigate CVE-2026-35227

Immediate Actions Required

• Identify all CODESYS-based devices exposing Modbus TCP and inventory their firmware versions against CERT@VDE VDE-2026-042.
• Restrict TCP/502 access using firewall allow-lists so only authorized HMI, SCADA, and engineering hosts can reach the server.
• Segment OT networks from corporate and internet-facing networks following IEC 62443 zone and conduit guidance.

Patch Information

Consult the CERT@VDE Security Advisory VDE-2026-042 for the list of fixed CODESYS Modbus TCP Server versions and vendor-supplied patches. Apply firmware updates from the device manufacturer once validated in a test environment, since OT patching requires change windows and operational verification.

Workarounds

• Place the Modbus TCP Server behind an industrial firewall or data diode that rate-limits new TCP connections per source.
• Disable the Modbus TCP Server on controllers that do not require it, reducing the attack surface.
• Configure connection timeouts and per-source connection caps on upstream network devices to slow exhaustion attempts.

# Example: restrict Modbus TCP (port 502) to a known SCADA host using iptables
iptables -A INPUT -p tcp --dport 502 -s 10.20.30.40 -j ACCEPT
iptables -A INPUT -p tcp --dport 502 -j DROP

# Example: rate-limit new connections to port 502 to mitigate exhaustion
iptables -A INPUT -p tcp --dport 502 --syn -m connlimit \
  --connlimit-above 5 --connlimit-mask 32 -j REJECT