Quick answers
- Is CVE-2026-110935 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-110935 being exploited in the wild.
- How severe is CVE-2026-110935?
- High severity, with a CVSS score of 8.4, published 4 November 2026.
- Which products and versions are affected?
- Phoenix Contact PLCnext Engineer prior to 2026.6.
- Is there a fix for CVE-2026-110935?
- Yes: fixed in PLCnext Engineer 2026.6. Until then: Install plugins only from trusted sources and verified engineering libraries. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-110935 attacked?
- It is attacked with local access, in a web application.
- Am I affected by CVE-2026-110935?
- Check whether you run Phoenix Contact PLCnext Engineer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: PLCnext Engineer 2026.6
Install plugins only from trusted sources and verified engineering libraries.
Technical details
The PFI plugin framework deployment routine fails to validate path components (specifically relative path segments like '..') when extracting archive entries to the plugin repository. This path traversal vulnerability (CWE-22) allows an unauthenticated local attacker to write files outside the intended plugin directory to arbitrary accessible locations. The vulnerability requires local access and no authentication or user interaction, resulting in arbitrary file write capabilities that could lead to code execution.
Affected products
- Phoenix Contact PLCnext Engineer prior to 2026.6
Timeline
- 2026-11-04: disclosed