Is CVE-2026-60035 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-60035 being exploited in the wild.

How severe is CVE-2026-60035?

High severity, with a CVSS score of 7.2, published 10 November 2026.

Which products and versions are affected?

Helmholz myREX24V2 before 2.21.0; Helmholz myREX24V2.virtual before 2.21.0.

Is there a fix for CVE-2026-60035?

Yes: fixed in myREX24V2 Firmware 2.21.0, myREX24V2.virtual Firmware 2.21.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-60035 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-60035?

Check whether you run Helmholz myREX24V2 or Helmholz myREX24V2.virtual at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-60035: Helmholz myREX24V2 code injection in network auth function

CVE-2026-60035 · Severity: high · CVSS 7.2 · Published 2026-11-10

Helmholz myREX24V2 is a gateway appliance that manages industrial network connections. A high-privileged attacker can inject malicious code through the network authentication function, gaining complete control over the device and all data it handles. An attacker with administrative access could execute arbitrary commands, leading to total compromise of the system.

Technologies: Helmholz myREX24V2, Helmholz myREX24V2.virtual. Vendors: Helmholz.

Quick answers

Is CVE-2026-60035 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-60035 being exploited in the wild.
How severe is CVE-2026-60035?: High severity, with a CVSS score of 7.2, published 10 November 2026.
Which products and versions are affected?: Helmholz myREX24V2 before 2.21.0; Helmholz myREX24V2.virtual before 2.21.0.
Is there a fix for CVE-2026-60035?: Yes: fixed in myREX24V2 Firmware 2.21.0, myREX24V2.virtual Firmware 2.21.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-60035 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-60035?: Check whether you run Helmholz myREX24V2 or Helmholz myREX24V2.virtual at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: myREX24V2 Firmware 2.21.0, myREX24V2.virtual Firmware 2.21.0

Technical details

OS command injection vulnerability (CWE-78) in the backends network auth function allows a high-privileged remote attacker to execute arbitrary code. The vulnerability requires high privilege access (PR:H) and can be exploited over the network without user interaction. Successful exploitation results in complete compromise of confidentiality, integrity, and availability.

Affected products

Helmholz myREX24V2 before 2.21.0
Helmholz myREX24V2.virtual before 2.21.0

Timeline

2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.