# CVE-2026-60073: AutomationDirect Productivity Suite out-of-bounds read via USB

Source: https://junglewise.ai/threats/cve-2026-60073-automationdirect-productivity-suite-out-of-bounds-read-via-usb  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-60073 · Severity: medium · CVSS 5.9 · Published 2026-07-16

AutomationDirect Productivity Suite, a software package used to program and manage industrial controllers, is affected by a security flaw. A person with physical access to the system could use a specially prepared USB device to cause the software to crash or leak sensitive system memory. This could disrupt manufacturing operations or expose internal technical data.

Technologies: [AutomationDirect Productivity Suite](https://junglewise.ai/threats/technologies/productivity-suite). Vendors: [AutomationDirect](https://junglewise.ai/threats/vendors/automationdirect).

## Quick answers

**Is CVE-2026-60073 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-60073 being exploited in the wild.

**How severe is CVE-2026-60073?** Medium severity, with a CVSS score of 5.9, published 16 July 2026.

**Which products and versions are affected?** AutomationDirect Productivity Suite <=v4.6.2.2.

**Is there a fix for CVE-2026-60073?** A patch was published on 2026-07-16: Fixed in version v4.7.0.47 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-60073 attacked?** It is attacked with physical access, in a network appliance.

**Am I affected by CVE-2026-60073?** Check whether you run AutomationDirect Productivity Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability (CWE-125) exists in AutomationDirect Productivity Suite versions 4.6.2.2 and earlier. The flaw allows a physical attacker with low privileges to control the length of data transmitted to a USB device. By exploiting this, an attacker can trigger a system crash (Denial of Service) or read sensitive kernel memory. The vulnerability is mitigated in version 4.7.0.47. Exploitation requires physical access to the engineering workstation.

## Affected products

- AutomationDirect Productivity Suite <=v4.6.2.2

## Timeline

- 2026-07-16: advisory
- 2026-07-16: disclosed
- 2026-07-16: patched: Fixed in version v4.7.0.47

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-197-04.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-197-04.json)
- [https://www.automationdirect.com/support/software-downloads](https://www.automationdirect.com/support/software-downloads)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-04](https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-04)

## Related threats

- [AutomationDirect Productivity Suite divide by zero vulnerability](https://junglewise.ai/threats/cve-2026-61378-automationdirect-productivity-suite-divide-by-zero-vulnerability)
- [AutomationDirect Productivity Suite out-of-bounds read via IOCTL](https://junglewise.ai/threats/cve-2026-57896-automationdirect-productivity-suite-out-of-bounds-read-via-ioctl)
- [AutomationDirect Productivity Suite out-of-bounds write via IOCTL](https://junglewise.ai/threats/cve-2026-61389-automationdirect-productivity-suite-out-of-bounds-write-via-ioctl)
- [AutomationDirect Productivity Suite out-of-bounds read via IOCTL request](https://junglewise.ai/threats/cve-2026-60140-automationdirect-productivity-suite-out-of-bounds-read-via-ioctl)
- [AutomationDirect Productivity Suite out-of-bounds write via IOCTL](https://junglewise.ai/threats/cve-2026-60063-automationdirect-productivity-suite-out-of-bounds-write-via-ioctl)