Is CVE-2026-63035 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63035 being exploited in the wild.

How severe is CVE-2026-63035?

High severity, with a CVSS score of 8.1, published 30 July 2026.

Which products and versions are affected?

o6 Automation open62541 1.3.0 to 1.3.17, 1.4.0 to 1.4.16, 1.5.0 to 1.5.4, master branch.

Is there a fix for CVE-2026-63035?

A patch was published on 2026-07-23: Fixes merged into 1.3 and 1.4 branches. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63035 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-63035?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63035: o6 Automation open62541 use-after-free in TransferSubscriptions service

CVE-2026-63035 · Severity: high · CVSS 8.1 · Published 2026-07-30

open62541 is an open-source implementation of OPC UA, a communication protocol used extensively in industrial automation and Internet of Things (IoT) environments. A security flaw in the way it handles subscription transfers could allow a logged-in attacker to crash the service or potentially run unauthorized code. This could lead to a loss of control over industrial equipment, operational downtime, or a breach of the system's integrity.

Quick answers

Is CVE-2026-63035 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63035 being exploited in the wild.
How severe is CVE-2026-63035?: High severity, with a CVSS score of 8.1, published 30 July 2026.
Which products and versions are affected?: o6 Automation open62541 1.3.0 to 1.3.17, 1.4.0 to 1.4.16, 1.5.0 to 1.5.4, master branch.
Is there a fix for CVE-2026-63035?: A patch was published on 2026-07-23: Fixes merged into 1.3 and 1.4 branches. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63035 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-63035?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap use-after-free vulnerability exists within the TransferSubscriptions service of the open62541 OPC UA library. The flaw is triggered when the service improperly manages memory during the transfer of subscriptions between sessions, allowing an authenticated attacker to reference memory that has already been freed. This can be exploited via network requests to cause a crash (Denial of Service) or potentially achieve arbitrary code execution. The vulnerability affects multiple stable branches including 1.3.x, 1.4.x, and 1.5.x, as well as the master branch. Fixes have been developed and submitted as pull requests to the project's repository.

Affected products

o6 Automation open62541 1.3.0 to 1.3.17, 1.4.0 to 1.4.16, 1.5.0 to 1.5.4, master branch

Timeline

2026-07-30: advisory: NVD and ICS-CERT published the advisory.
2026-07-23: patched: Fixes merged into 1.3 and 1.4 branches.
2026-07-24: patched: Fixes merged into 1.5 branch.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.