Is CVE-2026-27549 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27549 being exploited in the wild.

How severe is CVE-2026-27549?

High severity, with a CVSS score of 8.8, published 16 September 2026.

Which products and versions are affected?

Pepperl+Fuchs ICE2-8IOL-G65L-V1D < 1.7.4; Pepperl+Fuchs ICE2-8IOL-K45P-RJ45 < 1.7.4; Pepperl+Fuchs ICE2-8IOL-K45S-RJ45 < 1.7.4; Pepperl+Fuchs ICE2-8IOL1-G65L-V1D < 1.7.4; and 5 more.

Is there a fix for CVE-2026-27549?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-27549 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-27549?

Check whether you run Pepperl+Fuchs ICE2-8IOL-G65L-V1D, Pepperl+Fuchs ICE2-8IOL-K45P-RJ45, Pepperl+Fuchs ICE2-8IOL-K45S-RJ45 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27549: Pepperl+Fuchs ICE firmware command injection in attached_devices_tab

Q: Is there a fix for CVE-2026-27549?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-27549 attacked?

It is attacked over the network, in device firmware.

Q: Am I affected by CVE-2026-27549?

Check whether you run Pepperl+Fuchs ICE2-8IOL-G65L-V1D, Pepperl+Fuchs ICE2-8IOL-K45P-RJ45, Pepperl+Fuchs ICE2-8IOL-K45S-RJ45 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27549 · Severity: high · CVSS 8.8 · Published 2026-09-16

Pepperl+Fuchs ICE device firmware contains a command injection flaw in the file upload endpoint that allows authenticated operators to execute arbitrary system commands with root privileges. An attacker with operator credentials can inject malicious commands during file uploads, gaining complete control over the device and potentially compromising industrial automation systems that rely on these controllers.

Technologies: Pepperl+Fuchs ICE2-8IOL-G65L-V1D, Pepperl+Fuchs ICE2-8IOL-K45P-RJ45, Pepperl+Fuchs ICE2-8IOL-K45S-RJ45, Pepperl+Fuchs ICE2-8IOL1-G65L-V1D, Pepperl+Fuchs ICE3-8IOL-G65L-V1D, Pepperl+Fuchs ICE3-8IOL-G65L-V1D-Y, Pepperl+Fuchs ICE3-8IOL-K45P-RJ45, Pepperl+Fuchs ICE3-8IOL-K45S-RJ45, Pepperl+Fuchs ICE3-8IOL1-G65L-V1D. Vendors: Pepperl+Fuchs.

Quick answers

Is CVE-2026-27549 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27549 being exploited in the wild.
How severe is CVE-2026-27549?: High severity, with a CVSS score of 8.8, published 16 September 2026.
Which products and versions are affected?: Pepperl+Fuchs ICE2-8IOL-G65L-V1D < 1.7.4; Pepperl+Fuchs ICE2-8IOL-K45P-RJ45 < 1.7.4; Pepperl+Fuchs ICE2-8IOL-K45S-RJ45 < 1.7.4; Pepperl+Fuchs ICE2-8IOL1-G65L-V1D < 1.7.4; and 5 more.
Is there a fix for CVE-2026-27549?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-27549 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-27549?: Check whether you run Pepperl+Fuchs ICE2-8IOL-G65L-V1D, Pepperl+Fuchs ICE2-8IOL-K45P-RJ45, Pepperl+Fuchs ICE2-8IOL-K45S-RJ45 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in the /index.php/attached_devices_tab/do_upload endpoint where user-supplied input is not properly sanitized before being passed to OS-level commands. The vulnerability requires valid operator-level credentials to exploit but allows unauthenticated privilege escalation to root. An authenticated operator can craft a malicious upload request containing shell metacharacters that are executed with the highest system privileges. The affected versions are ICE2-* and ICE3-* firmware prior to 1.7.4, and a patch is available in version 1.7.4 or later.

Affected products

Pepperl+Fuchs ICE2-8IOL-G65L-V1D < 1.7.4
Pepperl+Fuchs ICE2-8IOL-K45P-RJ45 < 1.7.4
Pepperl+Fuchs ICE2-8IOL-K45S-RJ45 < 1.7.4
Pepperl+Fuchs ICE2-8IOL1-G65L-V1D < 1.7.4
Pepperl+Fuchs ICE3-8IOL-G65L-V1D < 1.7.4
Pepperl+Fuchs ICE3-8IOL-G65L-V1D-Y < 1.7.4
Pepperl+Fuchs ICE3-8IOL-K45P-RJ45 < 1.7.4
Pepperl+Fuchs ICE3-8IOL-K45S-RJ45 < 1.7.4
Pepperl+Fuchs ICE3-8IOL1-G65L-V1D < 1.7.4

Timeline

2026-09-16: disclosed: CVE-2026-27549 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.