# CVE-2026-110022: Phoenix Contact PLCnext Engineer PFI plugin code execution without integrity check

Source: https://junglewise.ai/threats/cve-2026-110022-the-pfi-plugin-framework-deploys-executable-assemblies-dlls-from  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-110022 · Severity: high · CVSS 8.4 · Published 2026-11-04

PLCnext Engineer is software used to program Siemens PLCnext industrial controllers. The PFI plugin framework loads executable assemblies (DLLs) from signed plugin packages, but fails to verify all archive contents before deployment. An attacker with local access can inject malicious unsigned code into a plugin package that overwrites legitimate signed assemblies and executes with full user privileges, compromising engineering systems and potentially deployed industrial devices.

Technologies: [Phoenix Contact PLCnext Engineer](https://junglewise.ai/threats/technologies/plcnext-engineer). Vendors: [Phoenix Contact](https://junglewise.ai/threats/vendors/phoenix-contact).

## Quick answers

**Is CVE-2026-110022 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110022 being exploited in the wild.

**How severe is CVE-2026-110022?** High severity, with a CVSS score of 8.4, published 4 November 2026.

**Which products and versions are affected?** Phoenix Contact PLCnext Engineer before 2026.6.

**Is there a fix for CVE-2026-110022?** Yes: fixed in PLCnext Engineer 2026.6. Until then: Install plugins only from trusted sources and verified engineering libraries.</anigation>
<parameter name="attack_vector">["local"] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110022 attacked?** It is in a web application.

**Am I affected by CVE-2026-110022?** Check whether you run Phoenix Contact PLCnext Engineer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in PLCnext Engineer 2026.6

Install plugins only from trusted sources and verified engineering libraries.</anigation>
<parameter name="attack_vector">["local"]

## Technical details

The vulnerability exploits a gap in the PFI plugin deployment signature verification: while the package signature covers certain entries, unsigned entries outside the signed prefix are still extracted and can overwrite previously verified signed DLLs. The plugin loader then instantiates the attacker-supplied code via reflection without additional integrity checks. An unauthenticated local attacker can craft a malicious plugin package to achieve code execution in the context of the PLCnext Engineer user (CWE-494: Download of Code Without Integrity Check).

## Affected products

- Phoenix Contact PLCnext Engineer before 2026.6

## Timeline

- 2026-11-04: disclosed
- 2026-11-04: patched: PLCnext Engineer 2026.6 released

## References

- [https://www.certvde.com/en/advisories/VDE-2026-121/](https://www.certvde.com/en/advisories/VDE-2026-121/)

## Related threats

- [Phoenix Contact PLCnext Engineer path traversal in plugin deployment](https://junglewise.ai/threats/cve-2026-110935-the-pfi-plugin-framework-deployment-routine-does-not-validate)
- [Phoenix Contact PLCnext Engineer GSDX signature verification bypass](https://junglewise.ai/threats/cve-2026-110021-plcnext-engineer-checks-gsdx-manifest-reference-digests-but-does)