OpenPLC Runtime v3
OpenPLC Runtime v3 XSS can hijack operator sessions and control PLC processes.
CISA published an ICS advisory for CVE-2026-88020, a cross-site scripting flaw in Autonomy Logic OpenPLC Runtime v3. The web interface uses an unencoded query-string parameter when routing programs, which can let an attacker hijack session cookies and issue operator requests. That access could control the programmable logic controller and the physical processes it drives. CVSS 3.1 is 6.1 and CVSS 4.0 is 5.3. OpenPLC 3 is affected, and CISA says no known public exploitation has been reported.
- CVE-2026-88020 is cross-site scripting in OpenPLC Runtime version 3.
- Unencoded query parameters can lead to operator session hijacking.
- A hijacked operator could control the PLC and physical processes.
- CISA reports no known public exploitation of this flaw.
- CVEs
- CVE-2026-88020
- Vendors
- Autonomy Logic
- Products
- OpenPLC Runtime
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-88020 | Reflected XSS in Autonomy Logic OpenPLC 3 Web Interface | 5.3 | — |
From the original article
2 min read at cisa.govView CSAF Summary Successful exploitation of this vulnerability could allow an attacker to hijack session cookies and issue state-changing requests as an operator which would allow the attacker to control the programmable logic controller and the physical processes it drives. The following versions of OpenPLC Runtime v3 are affected: OpenPLC 3 (CVE-2026-88020) CVSS Vendor Equipment Vulnerabilities v3 6.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.