Vendor
Phoenix Contact vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 31 vulnerabilities in Phoenix Contact: 0 in the last 7 days and 4 in the last 90 days, 9 of them critical and 0 exploited in the wild. The most recent, CVE-2026-110935, was published on 4 November 2026. 3 vulnerabilities in the last four weeks, up 200% on the four before (1). 7 technologies have a page of their own.
- Last 7 days
- 0
- Last 90 days
- 4
- Critical, all time
- 9
- Exploited in the wild
- 0
About Phoenix Contact
A German manufacturer of industrial automation, interconnection, and interface solutions.
Phoenix Contact technologies
Latest Phoenix Contact vulnerabilities
- CVE-2026-110935: Phoenix Contact PLCnext Engineer path traversal in plugin deploymenthighCVSS 8.4
- CVE-2026-110022: Phoenix Contact PLCnext Engineer PFI plugin code execution without integrity checkhighCVSS 8.4
- CVE-2026-110021: Phoenix Contact PLCnext Engineer GSDX signature verification bypassmediumCVSS 6.2
- CVE-2026-27550: Pepperl+Fuchs ICE2/ICE3 command injection in Field_Shadow_Password classhighCVSS 8.8EPSS 2.9%
- CVE-2025-41771: Phoenix Contact PLCnext SQL injection in notification endpointmediumCVSS 4.3EPSS 0.3%
- CVE-2025-41770: Phoenix Contact PLCnext denial-of-service in engineer interfacehighCVSS 7.5EPSS 0.5%
- CVE-2025-41769: Phoenix Contact PLCnext PROFINET buffer overflowcriticalCVSS 9.8EPSS 0.8%
- CVE-2026-7849: Phoenix Contact CHARX SEC command injection in system configurationcriticalCVSS 9.8
- CVE-2026-44108: Phoenix Contact CHARX SEC-3xxx firewall bypass during shutdowncriticalCVSS 9.8
- CVE-2026-44107: Phoenix Contact CHARX SEC charging controller unauthenticated reboot via Modbus TCPhighCVSS 7.5
- CVE-2026-44106: Phoenix Contact CHARX SEC-3xxx privilege escalation in init-scripthighCVSS 7.8
- CVE-2026-44105: Phoenix Contact CHARX SEC-3xxx credential exposure in log filesmediumCVSS 6.6
- CVE-2026-44104: Phoenix Contact CHARX SEC firmware update signature bypasscriticalCVSS 9.8
- CVE-2026-44103: Phoenix Contact CHARX SEC firmware integrity bypass in JupiCoremediumCVSS 5.3
- CVE-2026-44102: Phoenix Contact CHARX SEC race condition in firmware update cleanupmediumCVSS 5.3
- CVE-2026-44101: Phoenix Contact CHARX SEC-3xxx missing authentication in OCPP AgentcriticalCVSS 9.8
- CVE-2026-44100: Phoenix Contact CHARX SEC JupiCore missing authenticationcriticalCVSS 9.4
- CVE-2026-44099: Phoenix Contact CHARX SEC privilege escalation in system configurationhighCVSS 7.8
- CVE-2026-44098: Phoenix Contact CHARX SEC OS command injection in OCPP backendhighCVSS 8.6
- CVE-2026-44097: Phoenix Contact CHARX SEC unrestricted file upload in firmware REST endpointhighCVSS 7.1
- CVE-2026-44096: Phoenix Contact CHARX SEC-3xxx privilege escalation in udhcpchighCVSS 7.8
- CVE-2026-44095: Phoenix Contact CHARX SEC privilege escalation in network scripthighCVSS 7.8
- CVE-2026-44094: Phoenix Contact CHARX SEC insecure firmware fallbackhighCVSS 8.6
- CVE-2026-44093: Phoenix Contact CHARX SEC-3xxx privilege escalation in init-scripthighCVSS 7.8
- CVE-2026-44092: Phoenix Contact CHARX SEC-3xxx CRLF injection in ModbusServercriticalCVSS 9.1
Most severe Phoenix Contact vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2025-41769: Phoenix Contact PLCnext PROFINET buffer overflowcriticalCVSS 9.8EPSS 0.8%
- CVE-2026-7849: Phoenix Contact CHARX SEC command injection in system configurationcriticalCVSS 9.8
- CVE-2026-44108: Phoenix Contact CHARX SEC-3xxx firewall bypass during shutdowncriticalCVSS 9.8
- CVE-2026-44104: Phoenix Contact CHARX SEC firmware update signature bypasscriticalCVSS 9.8
- CVE-2026-44101: Phoenix Contact CHARX SEC-3xxx missing authentication in OCPP AgentcriticalCVSS 9.8
- CVE-2026-44090: Phoenix Contact CHARX SEC missing authentication in MQTT brokercriticalCVSS 9.8
- CVE-2026-44100: Phoenix Contact CHARX SEC JupiCore missing authenticationcriticalCVSS 9.4
- CVE-2026-44092: Phoenix Contact CHARX SEC-3xxx CRLF injection in ModbusServercriticalCVSS 9.1
- CVE-2026-44091: Phoenix Contact CHARX SEC trust boundary violation in MQTT BrokercriticalCVSS 9.1
- CVE-2026-27550: Pepperl+Fuchs ICE2/ICE3 command injection in Field_Shadow_Password classhighCVSS 8.8EPSS 2.9%
Vulnerabilities per week
3 vulnerabilities in the last four weeks, up 200% on the four before (1). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 1 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 3 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Phoenix Contact vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/phoenix-contact)<a href="https://junglewise.ai/threats/vendors/phoenix-contact"><img src="https://junglewise.ai/threats/vendors/phoenix-contact/badge.svg" alt="Phoenix Contact vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/phoenix-contact.json, and this page as text at https://junglewise.ai/threats/vendors/phoenix-contact.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Phoenix Contact vulnerabilities", https://junglewise.ai/threats/vendors/phoenix-contact, 12 November 2026.