Is CVE-2026-60073 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-60073 being exploited in the wild.

How severe is CVE-2026-60073?

Medium severity, with a CVSS score of 5.9, published 16 July 2026.

Which products and versions are affected?

AutomationDirect Productivity Suite <=v4.6.2.2.

Is there a fix for CVE-2026-60073?

A patch was published on 2026-07-16: Fixed in version v4.7.0.47 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-60073 attacked?

It is attacked with physical access, in a network appliance.

Am I affected by CVE-2026-60073?

Check whether you run AutomationDirect Productivity Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-60073: AutomationDirect Productivity Suite out-of-bounds read via USB

Q: Is there a fix for CVE-2026-60073?

A patch was published on 2026-07-16: Fixed in version v4.7.0.47 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-60073 attacked?

It is attacked with physical access, in a network appliance.

Q: Am I affected by CVE-2026-60073?

Check whether you run AutomationDirect Productivity Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-60073 · Severity: medium · CVSS 5.9 · Published 2026-07-16

AutomationDirect Productivity Suite, a software package used to program and manage industrial controllers, is affected by a security flaw. A person with physical access to the system could use a specially prepared USB device to cause the software to crash or leak sensitive system memory. This could disrupt manufacturing operations or expose internal technical data.

Technologies: AutomationDirect Productivity Suite. Vendors: AutomationDirect.

Quick answers

Is CVE-2026-60073 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-60073 being exploited in the wild.
How severe is CVE-2026-60073?: Medium severity, with a CVSS score of 5.9, published 16 July 2026.
Which products and versions are affected?: AutomationDirect Productivity Suite <=v4.6.2.2.
Is there a fix for CVE-2026-60073?: A patch was published on 2026-07-16: Fixed in version v4.7.0.47 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-60073 attacked?: It is attacked with physical access, in a network appliance.
Am I affected by CVE-2026-60073?: Check whether you run AutomationDirect Productivity Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read vulnerability (CWE-125) exists in AutomationDirect Productivity Suite versions 4.6.2.2 and earlier. The flaw allows a physical attacker with low privileges to control the length of data transmitted to a USB device. By exploiting this, an attacker can trigger a system crash (Denial of Service) or read sensitive kernel memory. The vulnerability is mitigated in version 4.7.0.47. Exploitation requires physical access to the engineering workstation.

Affected products

AutomationDirect Productivity Suite <=v4.6.2.2

Timeline

2026-07-16: advisory
2026-07-16: disclosed
2026-07-16: patched: Fixed in version v4.7.0.47

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.