Is CVE-2026-44097 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44097 being exploited in the wild.

How severe is CVE-2026-44097?

High severity, with a CVSS score of 7.1, published 30 July 2026.

Which products and versions are affected?

Phoenix Contact CHARX SEC-3000 Firmware < 1.9.1; Phoenix Contact CHARX SEC-3050 Firmware < 1.9.1; Phoenix Contact CHARX SEC-3100 Firmware < 1.9.1; Phoenix Contact CHARX SEC-3150 Firmware < 1.9.1.

Is there a fix for CVE-2026-44097?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-44097 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-44097?

Check whether you run Phoenix Contact CHARX SEC-3000, Phoenix Contact CHARX SEC-3050, Phoenix Contact CHARX SEC-3100 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44097: Phoenix Contact CHARX SEC unrestricted file upload in firmware REST endpoint

Q: Is there a fix for CVE-2026-44097?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-44097 attacked?

It is attacked over the network, in an operating system.

Q: Am I affected by CVE-2026-44097?

Check whether you run Phoenix Contact CHARX SEC-3000, Phoenix Contact CHARX SEC-3050, Phoenix Contact CHARX SEC-3100 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44097 · Severity: high · CVSS 7.1 · Published 2026-07-30

Phoenix Contact CHARX SEC charging controllers, which manage electric vehicle charging stations, contain a vulnerability in their firmware update interface. An attacker with basic 'operator' access can upload unauthorized files to the device's storage. This could allow an attacker to fill up the device's memory, potentially causing the charging station to crash or become unavailable for use.

Technologies: Phoenix Contact CHARX SEC-3000, Phoenix Contact CHARX SEC-3050, Phoenix Contact CHARX SEC-3100, Phoenix Contact CHARX SEC-3150. Vendors: Phoenix Contact.

Quick answers

Is CVE-2026-44097 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44097 being exploited in the wild.
How severe is CVE-2026-44097?: High severity, with a CVSS score of 7.1, published 30 July 2026.
Which products and versions are affected?: Phoenix Contact CHARX SEC-3000 Firmware < 1.9.1; Phoenix Contact CHARX SEC-3050 Firmware < 1.9.1; Phoenix Contact CHARX SEC-3100 Firmware < 1.9.1; Phoenix Contact CHARX SEC-3150 Firmware < 1.9.1.
Is there a fix for CVE-2026-44097?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44097 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-44097?: Check whether you run Phoenix Contact CHARX SEC-3000, Phoenix Contact CHARX SEC-3050, Phoenix Contact CHARX SEC-3100 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as Unrestricted Upload of File with Dangerous Type (CWE-434) within the REST API endpoint used for firmware updates. A remote attacker authenticated with 'operator' privileges can bypass intended file type restrictions to upload arbitrary files to the device's persistent storage. While the advisory does not explicitly confirm remote code execution, the primary impact is integrity loss and availability loss due to resource exhaustion (disk space). The issue affects CHARX SEC-3xxx series controllers with firmware versions prior to 1.9.1. Users are advised to update to firmware version 1.9.1 or later.

Affected products

Phoenix Contact CHARX SEC-3000 Firmware < 1.9.1
Phoenix Contact CHARX SEC-3050 Firmware < 1.9.1
Phoenix Contact CHARX SEC-3100 Firmware < 1.9.1
Phoenix Contact CHARX SEC-3150 Firmware < 1.9.1

Timeline

2026-07-30: advisory: VDE-2026-008 published by CERT VDE
2026-07-30: disclosed: CVE-2026-44097 published to NVD

References

https://www.certvde.com/en/advisories/VDE-2026-008/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.