# CVE-2026-45449: Unitronics UniStream Pro and UniLogic OS command injection

Source: https://junglewise.ai/threats/cve-2026-45449-improper-neutralization-of-special-elements-used-in-an-os-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-45449 · Severity: high · CVSS 8.3 · Published 2026-10-15

Unitronics UniStream Pro and UniLogic are programmable logic controllers (PLCs) used to automate industrial processes and manufacturing systems. An OS command injection vulnerability allows an attacker to execute arbitrary system commands on affected devices, potentially taking control of critical industrial systems and disrupting operations. This could lead to unauthorized access, data manipulation, or physical process interference in manufacturing environments.

Technologies: [Unitronics UniLogic](https://junglewise.ai/threats/technologies/unilogic), [Unitronics UniStream Pro](https://junglewise.ai/threats/technologies/unistream-pro). Vendors: [Unitronics](https://junglewise.ai/threats/vendors/unitronics).

## Quick answers

**Is CVE-2026-45449 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45449 being exploited in the wild.

**How severe is CVE-2026-45449?** High severity, with a CVSS score of 8.3, published 15 October 2026.

**Which products and versions are affected?** Unitronics UniLogic prior to 1.41.329; Unitronics UniStream Pro B10, C10.

**Is there a fix for CVE-2026-45449?** Yes: fixed in UniLogic 1.41.329. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-45449?** Check whether you run Unitronics UniLogic or Unitronics UniStream Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in UniLogic 1.41.329

## Technical details

The vulnerability is an OS command injection (CWE-78) in Unitronics UniStream Pro and UniLogic that allows execution of arbitrary OS commands. Affected versions are UniStream Pro B10/C10 and UniLogic versions prior to 1.41.329. The attack vector and specific preconditions for exploitation are not detailed in the advisory, but the ability to inject commands suggests interaction with a command interface or input field on the device.

## Affected products

- Unitronics UniStream Pro B10, C10
- Unitronics UniLogic prior to 1.41.329

## Timeline

- 2026-10-15: published

## References

- [https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0](https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0)

## Related threats

- [Unitronics UniStream Pro/UniLogic format string vulnerability](https://junglewise.ai/threats/cve-2026-45452-use-of-externally-controlled-format-string-vulnerability-in)
- [Unitronics UniStream Pro and UniLogic improper authentication](https://junglewise.ai/threats/cve-2026-45451-improper-authentication-vulnerability-in-unitronics-unitronics)
- [Unitronics UniStream Pro and UniLogic buffer overflow](https://junglewise.ai/threats/cve-2026-45450-improper-restriction-of-operations-within-the-bounds-of-a-memory)