Phoenix Contact PLCnext Engineer prior to 2026.6 affected by signature verification bypass and path traversal
Original title: [Control Systems] Phoenix Contact security advisory (AV26-1121)
PLCnext Engineer before 2026.6 has GSDX SignatureValue verification, signed plug-in validation bypass and path traversal issues.
The Canadian Centre for Cyber Security issued advisory AV26-1121 about vulnerabilities in Phoenix Contact's PLCnext Engineer programming software. The flaws involve GSDX SignatureValue verification, signed plug-in validation bypass and path traversal. Users and administrators are advised to review the provided web links and apply updates when available.
- PLCnext Engineer prior to 2026.6 is affected
- GSDX SignatureValue verification issue
- Signed plug-in validation bypass
- Path traversal vulnerabilities
- Updates to be applied
Impact: signature verification bypass and path traversal in PLCnext Engineer
| Product | Affected | Fixed in |
|---|---|---|
| Phoenix Contact PLCnext Engineer | prior to 2026.6 | 2026.6 |
- 1.review the provided web links
- 2.apply any necessary updates as they become available
- Vendors
- Phoenix Contact
- Products
- PLCnext Engineer
- Organizations
- Canadian Centre for Cyber Security
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-1121 Date: November 4, 2026 As of November 4, 2026, Phoenix Contact is affected by vulnerabilities in the following product: PLCnext Engineer Prior to 2026. 6 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.