[Control systems] CODESYS security advisory (AV26-983)
Canada's Cyber Centre warns of vulnerabilities in multiple CODESYS control products and urges updates.
On October 1, 2026, the Canadian Centre for Cyber Security issued advisory AV26-983 on CODESYS vulnerabilities current as of September 30, 2026. Affected software includes CODESYS Control RTE, Control Win, Development System, Gateway, HMI, Runtime Toolkit, Safety SIL2, Virtual Control, and multiple Linux and embedded Control variants, with fixes in 3.5.22.40 or 4.23.0.0 depending on the product. Named issues are uncontrolled memory allocation in the Gateway Client and improper synchronization in Control Runtime monitoring. The centre urges administrators to review the linked advisories and apply updates; the notice does not report exploitation.
- Advisory AV26-983, dated October 1, 2026, covers many CODESYS products.
- Fixed builds are 3.5.22.40 or 4.23.0.0, depending on the product.
- Named issues are uncontrolled memory allocation and improper synchronization.
- The notice does not report active exploitation and urges updates.
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-983 Date: October 1, 2026 As of September 30, 2026, CODESYS is affected by vulnerabilities in the following products: CODESYS Control RTE (SL) Prior to 3. 5. 22.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.