# CVE-2026-43852: Advantech ADAM-3600 EdgeLink arbitrary file write

Source: https://junglewise.ai/threats/cve-2026-43852-a-vulnerability-could-allow-an-authenticated-attacker-to-write  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-43852 · Severity: info · Published 2026-10-20

Advantech ADAM-3600 EdgeLink is an industrial remote terminal unit used for data acquisition and remote monitoring in operational technology environments. A file write vulnerability allows an authenticated user to write files to any location on the system, potentially leading to unauthorized code execution, configuration tampering, or system compromise. An attacker with valid credentials could leverage this to gain persistent control of critical infrastructure devices.

Technologies: [Advantech ADAM-3600 EdgeLink](https://junglewise.ai/threats/technologies/adam-3600-edgelink). Vendors: [Advantech](https://junglewise.ai/threats/vendors/advantech).

## Quick answers

**Is CVE-2026-43852 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43852 being exploited in the wild.

**How severe is CVE-2026-43852?** Informational severity, published 20 October 2026.

**Which products and versions are affected?** Advantech ADAM-3600 EdgeLink.

**Is there a fix for CVE-2026-43852?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-43852 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-43852?** Check whether you run Advantech ADAM-3600 EdgeLink. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authenticated attacker can write files to arbitrary locations on the ADAM-3600 EdgeLink system via an unspecified mechanism in the product's web interface or API. The vulnerability requires valid authentication credentials but no additional user interaction. Successful exploitation allows an attacker to overwrite critical system files, deploy malicious code, or modify device configuration to achieve code execution or persistence.

## Affected products

- Advantech ADAM-3600 EdgeLink

## Timeline

- 2026-10-20: disclosed

## References

- [https://www.advantech.com/en/security-advisory](https://www.advantech.com/en/security-advisory)
- [https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-149](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-149)

## Related threats

- [Advantech ADAM-3600 EdgeLink stack-based buffer overflow in login](https://junglewise.ai/threats/cve-2026-43858-a-stack-based-buffer-overflow-vulnerability-could-allow-a-remote)
- [Advantech ADAM-3600 EdgeLink arbitrary code execution via proprietary protocol](https://junglewise.ai/threats/cve-2026-43857-a-vulnerability-could-allow-a-remote-authenticated-attacker-to)
- [Advantech ADAM-3600 stack-based buffer overflow in FileProcess CheckDir](https://junglewise.ai/threats/cve-2026-43856-a-stack-based-buffer-overflow-vulnerability-in-the-fileprocess)
- [Advantech ADAM-3600 EdgeLink heap buffer overflow remote authenticated code execution](https://junglewise.ai/threats/cve-2026-43855-a-heap-based-buffer-overflow-vulnerability-could-allow-a-remote)
- [Advantech ADAM-3600 EdgeLink sensitive data exposure in project files](https://junglewise.ai/threats/cve-2026-43854-a-vulnerability-could-allow-an-attacker-with-access-to-an)