Quick answers
- Is CVE-2026-0393 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-0393 being exploited in the wild.
- How severe is CVE-2026-0393?
- Informational severity, with a CVSS score of 6.9, published 21 May 2026.
- Which products and versions are affected?
- CODESYS Visualization < 4.10.0.0.
- Is there a fix for CVE-2026-0393?
- A patch was published on 2026-05-21: Fixed in CODESYS Visualization 4.10.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-0393 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-0393?
- Check whether you run CODESYS Visualization at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability classified as CWE-522 (Insufficiently Protected Credentials) exists in CODESYS Visualization versions prior to 4.10.0.0. The root cause is insufficient isolation of authentication data during concurrent login operations within an active visualization session. An authenticated remote user with low privileges can exploit this race condition to obtain the credentials of another user logging in at the same time. This vulnerability requires user interaction (the victim must be logging in) and can be triggered via both local and remote access. A fix is available in version 4.10.0.0, though existing projects require recompilation and redeployment to the PLC/HMI to be protected.
Affected products
- CODESYS Visualization < 4.10.0.0
Timeline
- 2026-05-21: disclosed: Initial advisory publication by CERT@VDE and CODESYS
- 2026-05-21: patched: Fixed in CODESYS Visualization 4.10.0.0