Is CVE-2026-66720 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66720 being exploited in the wild.

How severe is CVE-2026-66720?

Medium severity, with a CVSS score of 6.5, published 30 July 2026.

Which products and versions are affected?

MZ Automation GmbH libiec61850 < 1.6.2.

Is there a fix for CVE-2026-66720?

A patch was published on 2026-07-30: Fixed in version 1.6.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-66720 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-66720?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66720: MZ Automation GmbH libiec61850 heap out-of-bounds read in GOOSE subscriber

Q: Is there a fix for CVE-2026-66720?

A patch was published on 2026-07-30: Fixed in version 1.6.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-66720 attacked?

It is attacked from the adjacent network, in a software library.

Q: Am I affected by CVE-2026-66720?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66720 · Severity: medium · CVSS 6.5 · Published 2026-07-30

A vulnerability exists in a specialized communication library used in energy and industrial control systems. An attacker on the same local network could send a malicious message that causes the system to crash. This would result in a denial-of-service, potentially disrupting critical infrastructure operations and monitoring.

Quick answers

Is CVE-2026-66720 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66720 being exploited in the wild.
How severe is CVE-2026-66720?: Medium severity, with a CVSS score of 6.5, published 30 July 2026.
Which products and versions are affected?: MZ Automation GmbH libiec61850 < 1.6.2.
Is there a fix for CVE-2026-66720?: A patch was published on 2026-07-30: Fixed in version 1.6.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66720 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-66720?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a heap out-of-bounds read (CWE-125) located within the GOOSE subscriber component of libiec61850. The root cause is improper validation of the UTC timestamp field in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2 multicast messages. An attacker can trigger this by sending a specially crafted GOOSE frame containing an undersized timestamp field. Successful exploitation allows an unauthenticated attacker on the adjacent network to crash the subscriber process, resulting in a denial-of-service (DoS) condition. The issue is resolved in version 1.6.2.

Affected products

MZ Automation GmbH libiec61850 < 1.6.2

Timeline

2026-07-30: advisory
2026-07-30: patched: Fixed in version 1.6.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.