CVE-2026-110022
Received Received - Intake

Arbitrary Code Execution in PFI Plugin Framework

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: CERT VDE

Description
The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the signature verification. An unauthenticated local attacker can replace an unsigned DLL outside the signed prefix in the archive passes verification and overwrites the legitimate signed assembly at the same destination path. The plugin loader then instantiates the attacker-supplied code without any additional integrity check resulting in a full compromise of the affected systems.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-110022
EUVD
EUVD-2026-116803

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Phoenix Contact PLCnext Engineer 0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-494 The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the PFI plugin framework in Phoenix Contact PLCnext Engineer software. It allows an unauthenticated local attacker to replace an unsigned DLL in a plugin package with malicious code. The framework fails to verify the signature of all archive entries, only checking some. The attacker can overwrite a legitimate signed DLL, leading the plugin loader to execute the attacker's code without further checks, fully compromising the system.

Impact Analysis

An attacker could gain full control over the affected system by replacing a DLL with malicious code. This could allow unauthorized access, data theft, system manipulation, or disruption of operations. The impact includes potential loss of confidentiality, integrity, and availability of the system and its data.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's security rules. Organizations may face compliance violations, legal penalties, and reputational damage due to compromised systems handling sensitive data.

Mitigation Strategies

Update Phoenix Contact PLCnext Engineer to version 2026.6 or later to address the signature verification flaw in the PFI plugin framework.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110022. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...