CVE-2026-88020: Autonomy Logic OpenPLC 3 XSS Vulnerability

CVE-2026-88020 Overview

CVE-2026-88020 is a reflected cross-site scripting (XSS) vulnerability in the Autonomy Logic OpenPLC 3 web interface. The flaw stems from improper neutralization of input during web page generation [CWE-79]. The web interface routes program selection based on a query string parameter that is rendered without encoding. An attacker can craft a malicious URL that, when opened by an authenticated operator, executes attacker-controlled script in the victim's browser session against the OpenPLC runtime.

OpenPLC is an open-source programmable logic controller runtime used in industrial control system (ICS) research, education, and deployments. CISA published this issue in ICS Advisory ICSA-26-265-09.

Critical Impact
An attacker who convinces an authenticated OpenPLC operator to visit a crafted link can execute arbitrary JavaScript in the operator's browser, enabling session hijacking, configuration tampering, and pivoting into the industrial control environment.

Affected Products

Autonomy Logic OpenPLC 3 (web interface component)
Deployments exposing the OpenPLC web interface to reachable networks
Engineering workstations that access the OpenPLC web console

Discovery Timeline

2026-09-22 - CVE-2026-88020 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-88020

Vulnerability Analysis

The OpenPLC 3 web interface accepts a query string parameter that selects which program to route. The handler embeds the parameter value directly into the generated HTML response without applying output encoding or contextual escaping. Because the parameter is reflected verbatim, an attacker can inject HTML and JavaScript that execute in the context of the OpenPLC web origin.

Exploitation requires user interaction. A logged-in operator must load an attacker-supplied URL, typically delivered through phishing, a chat message, or a link embedded in a compromised page. Once executed, the injected script runs with the operator's session privileges and can read authenticated pages, submit forms, and interact with the runtime's control surface.

The classification aligns with CWE-79: Improper Neutralization of Input During Web Page Generation. See the CISA ICS Advisory ICSA-26-265-09 for the vendor coordination details.

Root Cause

The web interface treats the routing query string parameter as trusted display data. It performs no HTML entity encoding, no attribute-context escaping, and no allow-list validation before writing the value into the response body. Any script payload placed in that parameter is parsed and executed by the browser.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL pointing at the OpenPLC web interface with a script payload in the vulnerable query string parameter. The attacker delivers the link to an authenticated operator. When the operator loads the URL, the browser executes the injected script under the OpenPLC web origin, exposing session cookies, tokens, and control functionality reachable from that session.

Refer to the CSAF advisory file on GitHub for the machine-readable advisory content. No public proof-of-concept exploit was listed at the time of publication.

Detection Methods for CVE-2026-88020

Indicators of Compromise

Web server access logs containing query string values with <script>, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E directed at the OpenPLC routing endpoint.
Referrers pointing at unexpected external domains immediately before authenticated OpenPLC actions.
Browser console errors or content security policy violations reported by operator workstations that access OpenPLC.

Detection Strategies

Inspect OpenPLC HTTP access logs for reflected payloads in the program-routing query parameter and alert on HTML or script metacharacters.
Deploy a web application firewall rule in front of the OpenPLC interface to flag XSS patterns in query strings.
Correlate operator authentication events with outbound network connections from engineering workstations to unknown domains shortly after login.

Monitoring Recommendations

Forward OpenPLC web server logs and workstation browser telemetry into a centralized analytics pipeline for retrospective hunting.
Monitor for unexpected changes to loaded PLC programs, user accounts, or runtime configuration that follow a suspicious link click.
Track new external referrers observed against the OpenPLC web origin and alert on first-seen values.

How to Mitigate CVE-2026-88020

Immediate Actions Required

Restrict network access to the OpenPLC web interface so it is reachable only from a dedicated engineering network segment.
Require operators to open the OpenPLC console directly from a bookmark and avoid clicking OpenPLC URLs received by email or chat.
Terminate active OpenPLC sessions and rotate operator credentials if a suspicious link is suspected to have been opened.

Patch Information

No fixed version was listed in the NVD record at publication. Monitor the CISA ICS Advisory ICSA-26-265-09 and the Autonomy Logic OpenPLC project for a coordinated fix, and apply it as soon as it is released. Track the CSAF advisory file for machine-readable updates.

Workarounds

Place the OpenPLC web interface behind a reverse proxy that enforces a strict Content Security Policy and blocks inline script execution.
Filter or reject requests to the routing endpoint whose query parameters contain HTML or JavaScript metacharacters.
Require multi-factor authentication and short session lifetimes for accounts that access OpenPLC to reduce the value of hijacked sessions.
Segment the ICS network so that a compromised engineering workstation cannot reach production controllers directly.

bash

# Example nginx snippet to block obvious XSS payloads and enforce CSP
# in front of the OpenPLC web interface
location / {
    if ($args ~* "(<|%3C)script|javascript:|onerror=|onload=") {
        return 400;
    }
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'" always;
    add_header X-Content-Type-Options "nosniff" always;
    proxy_pass http://openplc_backend;
}