Is CVE-2026-110021 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110021 being exploited in the wild.

How severe is CVE-2026-110021?

Medium severity, with a CVSS score of 6.2, published 4 November 2026.

Which products and versions are affected?

Phoenix Contact PLCnext Engineer prior to 2026.6.

How is CVE-2026-110021 attacked?

It is attacked with local access, in a web application.

Am I affected by CVE-2026-110021?

Check whether you run Phoenix Contact PLCnext Engineer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110021: Phoenix Contact PLCnext Engineer GSDX signature verification bypass

CVE-2026-110021 · Severity: medium · CVSS 6.2 · Published 2026-11-04

PLCnext Engineer is a software tool used by engineers to design and configure PROFINET industrial control systems. This vulnerability allows an attacker to tamper with device configuration files (GSDML) and have them accepted as valid without any warning, potentially causing incorrect behavior or malicious settings to be deployed to factory equipment and control systems. An attacker with local access can modify these files and inject manipulated device definitions or parameters that propagate unchecked into production environments.

Technologies: Phoenix Contact PLCnext Engineer. Vendors: Phoenix Contact.

Quick answers

Is CVE-2026-110021 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110021 being exploited in the wild.
How severe is CVE-2026-110021?: Medium severity, with a CVSS score of 6.2, published 4 November 2026.
Which products and versions are affected?: Phoenix Contact PLCnext Engineer prior to 2026.6.
Is there a fix for CVE-2026-110021?: Yes: fixed in PLCnext Engineer 2026.6. Until then: Install plugins only from trusted sources and verified engineering libraries. To mitigate this GSDX vulnerability, use external tools to verify the signature before importing device descriptions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110021 attacked?: It is attacked with local access, in a web application.
Am I affected by CVE-2026-110021?: Check whether you run Phoenix Contact PLCnext Engineer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: PLCnext Engineer 2026.6

Install plugins only from trusted sources and verified engineering libraries. To mitigate this GSDX vulnerability, use external tools to verify the signature before importing device descriptions.

Technical details

PLCnext Engineer validates GSDX manifest reference digests but fails to cryptographically verify the XML SignatureValue against the canonicalized SignedInfo element. An unauthenticated local attacker can modify signed GSDML content, update its manifest digest, retain the public certificate, and supply an invalid SignatureValue while the application still reports the package as Valid. This signature verification bypass (CWE-347) requires local access but no authentication or user interaction, allowing arbitrary PROFINET device descriptions to be imported as trusted.

Affected products

Phoenix Contact PLCnext Engineer prior to 2026.6

Timeline

2026-11-04: disclosed

References

https://www.certvde.com/en/advisories/VDE-2026-121/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.