# CVE-2026-60038: Helmholz myREX24V2 code injection in ImportPKCS12 function

Source: https://junglewise.ai/threats/cve-2026-60038-a-high-privileged-remote-attacker-can-perform-an-openssl-code  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-60038 · Severity: high · CVSS 7.2 · Published 2026-11-10

Helmholz myREX24V2 is a control and automation device used in industrial environments. A high-privileged attacker can inject malicious code through the certificate import function, gaining complete control over the device and potentially disrupting critical industrial processes.

Technologies: [Helmholz myREX24V2](https://junglewise.ai/threats/technologies/myrex24v2), [Helmholz myREX24V2.virtual](https://junglewise.ai/threats/technologies/myrex24v2-virtual). Vendors: [Helmholz](https://junglewise.ai/threats/vendors/helmholz).

## Quick answers

**Is CVE-2026-60038 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-60038 being exploited in the wild.

**How severe is CVE-2026-60038?** High severity, with a CVSS score of 7.2, published 10 November 2026.

**Which products and versions are affected?** Helmholz myREX24V2 before 2.21.0; Helmholz myREX24V2.virtual before 2.21.0.

**Is there a fix for CVE-2026-60038?** Yes: fixed in 2.21.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-60038 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-60038?** Check whether you run Helmholz myREX24V2 or Helmholz myREX24V2.virtual at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.21.0

## Technical details

An OS command injection vulnerability in the ImportPKCS12 function allows a high-privileged attacker to execute arbitrary code by manipulating OpenSSL arguments. The attack requires authentication with administrative privileges and network access. Successful exploitation results in complete system compromise with loss of confidentiality, integrity, and availability.

## Affected products

- Helmholz myREX24V2 before 2.21.0
- Helmholz myREX24V2.virtual before 2.21.0

## Timeline

- 2026-11-10: disclosed

## References

- [https://www.certvde.com/en/advisories/VDE-2026-079/](https://www.certvde.com/en/advisories/VDE-2026-079/)
- [https://www.certvde.com/en/advisories/VDE-2026-141/](https://www.certvde.com/en/advisories/VDE-2026-141/)

## Related threats

- [Helmholz myREX24V2 unauthenticated password reset DoS](https://junglewise.ai/threats/cve-2026-60046-an-unauthenticated-remote-attacker-can-perform-password-resets)
- [Helmholz myREX24V2 arbitrary file upload to guessable location](https://junglewise.ai/threats/cve-2026-60045-a-high-privileged-remote-attacker-can-upload-arbitrary-files-to-a)
- [Helmholz myREX24V2 cross-site scripting in backend](https://junglewise.ai/threats/cve-2026-60043-an-unauthenticated-remote-attacker-can-perform-a-xss-attack-on-a)
- [Helmholz myREX24V2 authentication bypass in com_check](https://junglewise.ai/threats/cve-2026-60042-an-unauthenticated-remote-attacker-can-perform-an-authentication)
- [Helmholz myREX24V2 CSRF attack on backend user](https://junglewise.ai/threats/cve-2026-60041-an-unauthenticated-remote-attacker-can-perform-a-csrf-attack-on-a)