Is CVE-2026-52134 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52134 being exploited in the wild.

How severe is CVE-2026-52134?

Informational severity, with a CVSS score of 0, published 31 July 2026.

Is there a fix for CVE-2026-52134?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-52134 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-52134?

Check whether you run MZ Automation libIEC61850 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52134: MZ Automation libiec61850 authentication bypass in parseGoosePayload

CVE-2026-52134 · Severity: info · CVSS 0 · Published 2026-07-31

A security flaw exists in libiec61850, an open-source library used in industrial automation and power grid systems to facilitate communication between electrical devices. An attacker with access to the local network could potentially bypass security checks by replaying captured data packets. This could allow unauthorized commands to be sent to critical infrastructure equipment, potentially disrupting operations or causing equipment malfunction.

Technologies: MZ Automation libIEC61850. Vendors: MZ Automation.

Quick answers

Is CVE-2026-52134 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52134 being exploited in the wild.
How severe is CVE-2026-52134?: Informational severity, with a CVSS score of 0, published 31 July 2026.
Which products and versions are affected?: MZ Automation libIEC61850 1.6.
Is there a fix for CVE-2026-52134?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-52134 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-52134?: Check whether you run MZ Automation libIEC61850 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass vulnerability exists in the parseGoosePayload() function within /goose/goose_receiver.c of libiec61850 v1.6. The flaw relates to how the library handles Generic Object Oriented Substation Event (GOOSE) frames, specifically failing to properly validate or prevent the replay of captured frames. An attacker on the same local network (Layer 2) can capture legitimate GOOSE traffic and replay it to bypass authentication mechanisms. This could lead to unauthorized control of Intelligent Electronic Devices (IEDs) in industrial environments. While the advisory is marked as 'info' by some sources, the nature of authentication bypass in industrial protocols typically warrants a higher severity assessment.

Affected products

MZ Automation libiec61850 1.6

Timeline

2026-07-31: disclosed: CVE-2026-52134 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.