Is CVE-2026-82774 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82774 being exploited in the wild.

How severe is CVE-2026-82774?

High severity, with a CVSS score of 8.8, published 14 September 2026.

Which products and versions are affected?

Contec CONPROSYS M2M Gateway Configurable Type CPS-MGS341* prior to 4.1.0; Contec CONPROSYS M2M Gateway Integrated Type CPS-MG341* prior to 4.1.0.

Is there a fix for CVE-2026-82774?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82774 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-82774?

Check whether you run Contec CONPROSYS M2M Gateway Configurable Type or Contec CONPROSYS M2M Gateway Integrated Type at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82774: Contec CONPROSYS M2M Gateway OS command injection

CVE-2026-82774 · Severity: high · CVSS 8.8 · Published 2026-09-14

Contec CONPROSYS M2M Gateway is a networked device that bridges industrial equipment communications. A vulnerability allows authenticated users to execute arbitrary operating system commands on the gateway, potentially compromising the integrity of industrial systems and the data they manage. This could enable an insider threat or an attacker who has obtained login credentials to take complete control of the device and connected systems.

Vendors: Contec.

Quick answers

Is CVE-2026-82774 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82774 being exploited in the wild.
How severe is CVE-2026-82774?: High severity, with a CVSS score of 8.8, published 14 September 2026.
Which products and versions are affected?: Contec CONPROSYS M2M Gateway Configurable Type CPS-MGS341* prior to 4.1.0; Contec CONPROSYS M2M Gateway Integrated Type CPS-MG341* prior to 4.1.0.
Is there a fix for CVE-2026-82774?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82774 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-82774?: Check whether you run Contec CONPROSYS M2M Gateway Configurable Type or Contec CONPROSYS M2M Gateway Integrated Type at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is an OS command injection (CWE-78) that exists in CONPROSYS M2M Gateway Series (both Integrated Type CPS-MG341* and Configurable type CPS-MGS341*) in versions prior to 4.1.0. The attack vector is network-based and requires valid authentication credentials. An attacker with authenticated access can inject malicious OS commands through improperly sanitized input fields, leading to arbitrary command execution with the privileges of the gateway process. Contec has released patched versions 4.1.0 and later that address this vulnerability.

Affected products

Contec CONPROSYS M2M Gateway Integrated Type CPS-MG341* prior to 4.1.0
Contec CONPROSYS M2M Gateway Configurable Type CPS-MGS341* prior to 4.1.0

Timeline

2026-09-10: disclosed: Vulnerability disclosed by Contec via JVN advisory JVNVU#96551518
2026-09-14: advisory: CVE-2026-82774 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.