Quick answers
- Is CVE-2026-110022 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-110022 being exploited in the wild.
- How severe is CVE-2026-110022?
- High severity, with a CVSS score of 8.4, published 4 November 2026.
- Which products and versions are affected?
- Phoenix Contact PLCnext Engineer before 2026.6.
- Is there a fix for CVE-2026-110022?
- Yes: fixed in PLCnext Engineer 2026.6. Until then: Install plugins only from trusted sources and verified engineering libraries.</anigation> <parameter name="attack_vector">["local"] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-110022 attacked?
- It is in a web application.
- Am I affected by CVE-2026-110022?
- Check whether you run Phoenix Contact PLCnext Engineer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: PLCnext Engineer 2026.6
Install plugins only from trusted sources and verified engineering libraries.</anigation> <parameter name="attack_vector">["local"]
Technical details
The vulnerability exploits a gap in the PFI plugin deployment signature verification: while the package signature covers certain entries, unsigned entries outside the signed prefix are still extracted and can overwrite previously verified signed DLLs. The plugin loader then instantiates the attacker-supplied code via reflection without additional integrity checks. An unauthenticated local attacker can craft a malicious plugin package to achieve code execution in the context of the PLCnext Engineer user (CWE-494: Download of Code Without Integrity Check).
Affected products
- Phoenix Contact PLCnext Engineer before 2026.6
Timeline
- 2026-11-04: disclosed
- 2026-11-04: patched: PLCnext Engineer 2026.6 released