Is CVE-2026-45449 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45449 being exploited in the wild.

How severe is CVE-2026-45449?

High severity, with a CVSS score of 8.3, published 15 October 2026.

Which products and versions are affected?

Unitronics UniLogic prior to 1.41.329; Unitronics UniStream Pro B10, C10.

Is there a fix for CVE-2026-45449?

Yes: fixed in UniLogic 1.41.329. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Am I affected by CVE-2026-45449?

Check whether you run Unitronics UniLogic or Unitronics UniStream Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45449: Unitronics UniStream Pro and UniLogic OS command injection

CVE-2026-45449 · Severity: high · CVSS 8.3 · Published 2026-10-15

Unitronics UniStream Pro and UniLogic are programmable logic controllers (PLCs) used to automate industrial processes and manufacturing systems. An OS command injection vulnerability allows an attacker to execute arbitrary system commands on affected devices, potentially taking control of critical industrial systems and disrupting operations. This could lead to unauthorized access, data manipulation, or physical process interference in manufacturing environments.

Technologies: Unitronics UniLogic, Unitronics UniStream Pro. Vendors: Unitronics.

Quick answers

Is CVE-2026-45449 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45449 being exploited in the wild.
How severe is CVE-2026-45449?: High severity, with a CVSS score of 8.3, published 15 October 2026.
Which products and versions are affected?: Unitronics UniLogic prior to 1.41.329; Unitronics UniStream Pro B10, C10.
Is there a fix for CVE-2026-45449?: Yes: fixed in UniLogic 1.41.329. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-45449?: Check whether you run Unitronics UniLogic or Unitronics UniStream Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: UniLogic 1.41.329

Technical details

The vulnerability is an OS command injection (CWE-78) in Unitronics UniStream Pro and UniLogic that allows execution of arbitrary OS commands. Affected versions are UniStream Pro B10/C10 and UniLogic versions prior to 1.41.329. The attack vector and specific preconditions for exploitation are not detailed in the advisory, but the ability to inject commands suggests interaction with a command interface or input field on the device.

Affected products

Unitronics UniStream Pro B10, C10
Unitronics UniLogic prior to 1.41.329

Timeline

2026-10-15: published

References

https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.