# CVE-2026-35226: CODESYS PROFINET Controller out-of-bounds write denial of service

Source: https://junglewise.ai/threats/cve-2026-35226-codesys-profinet-controller-out-of-bounds-write-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-35226 · Severity: medium · CVSS 6.5 · Published 2026-07-29

A vulnerability exists in the CODESYS PROFINET Controller, a component used in industrial automation to manage communication between controllers and field devices. An attacker on the same local network can send specially crafted data to crash the Programmable Logic Controller (PLC) application. This results in a controlled stop of the industrial process, potentially leading to operational downtime until the system is manually restarted.

Vendors: [CODESYS](https://junglewise.ai/threats/vendors/codesys).

## Quick answers

**Is CVE-2026-35226 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35226 being exploited in the wild.

**How severe is CVE-2026-35226?** Medium severity, with a CVSS score of 6.5, published 29 July 2026.

**Which products and versions are affected?** CODESYS PROFINET >= 4.4.0.0, < 4.8.0.0.

**Is there a fix for CVE-2026-35226?** A patch was published on 2026-07-29: Update to version 4.8.0.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35226 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-35226?** Check whether you run CODESYS PROFINET at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds write vulnerability (CWE-787) exists in the CODESYS PROFINET protocol stack during the processing of received PROFINET communication data. The flaw is located within the PROFINET Controller add-on, which is executed by the CODESYS Control runtime system. An unauthenticated attacker with adjacent network access can send malformed packets to trigger an exception. While the runtime system handles the exception to prevent arbitrary code execution, it results in a Denial of Service (DoS) by forcing the PLC application into a controlled stop. The vulnerability is resolved in version 4.8.0.0; users must update the component in their project device tree and redeploy the application to the PLC for the fix to take effect.

## Affected products

- CODESYS CODESYS PROFINET >= 4.4.0.0, < 4.8.0.0

## Timeline

- 2026-07-29: disclosed: Initial revision of VDE-2026-041 published
- 2026-07-29: patched: Update to version 4.8.0.0 released

## References

- [https://www.certvde.com/en/advisories/VDE-2026-041/](https://www.certvde.com/en/advisories/VDE-2026-041/)