Security Digest: July 11, 2026 - 6 Critical Vulnerabilities

Today’s alerts include two critical OpenPLC and charging-station issues with direct exposure to remote compromise or privilege escalation, plus high-severity flaws in Spinnaker and ModSecurity that can enable remote code execution or weaken request inspection. Teams running industrial control, CI/CD, or WAF infrastructure should patch first, then restrict access and verify exposure immediately.

· 7 min read

Urgent Security Digest: Six Critical Vulnerabilities Demand Immediate Action

Executive Summary

Today’s alerts include two critical OpenPLC and charging-station issues with direct exposure to remote compromise or privilege escalation, plus high-severity flaws in Spinnaker and ModSecurity that can enable remote code execution or weaken request inspection. Teams running industrial control, CI/CD, or WAF infrastructure should patch first, then restrict access and verify exposure immediately.

The most urgent risk is active exploitation of systems that accept attacker-controlled input or unauthenticated connections. If you operate any affected platform, apply vendor fixes now and isolate vulnerable services until updates are confirmed.

Critical Vulnerabilities

CVE-2026-14480: OpenPLC Runtime v3 authenticated arbitrary file write leading to code execution

  • Impact: An authenticated attacker can write files anywhere the OpenPLC webserver can access. In the default build flow, this can be turned into native code execution by planting a malicious .cpp file and triggering a normal compile/start cycle.
  • Affected Systems: OpenPLC Runtime v3 legacy web UI program-upload workflow.
  • Immediate Action: Disable or restrict the legacy web UI now, review all authenticated user access, and check for unexpected files in runtime core directories.
  • Mitigation: Apply the vendor fix as soon as available; until then, limit access to trusted admin networks only and monitor for abnormal program uploads or filesystem writes.

CVE-2026-20744: Charging station websocket endpoint lacks authentication

  • Impact: Attackers may connect without proper authentication and potentially gain privileged access to the charging station environment.
  • Affected Systems: Charging station websocket endpoint.
  • Immediate Action: Block external access immediately, place the endpoint behind authenticated network controls, and review logs for unexpected websocket sessions.
  • Mitigation: Apply the vendor update or disable the endpoint until patched; restrict access to management networks only.

CVE-2026-44795: Spinnaker unsafe YAML processing in CloudFormation and CloudFoundry baking

  • Impact: Unsafe deserialization can allow attackers to load arbitrary Java classes and achieve remote code execution.
  • Affected Systems: Spinnaker versions prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3.
  • Immediate Action: Upgrade immediately to a fixed release line and pause CloudFormation/CloudFoundry bake workflows if patching is delayed.
  • Mitigation: Move to 2026.1.0, 2026.0.3, 2025.4.4, or 2025.3.3 depending on your branch; review pipelines for untrusted YAML inputs.

CVE-2026-52747: ModSecurity multipart parser strips line breaks and can miss payloads

  • Impact: Attackers can hide dangerous syntax in form fields so ModSecurity rules inspecting ARGS or ARGS_POST may miss the attack. This can help malicious requests reach backend apps.
  • Affected Systems: ModSecurity / libmodsecurity prior to 3.0.16.
  • Immediate Action: Upgrade WAF engines now and test critical rules against multipart form traffic.
  • Mitigation: Install 3.0.16; until then, add compensating controls at the application layer and review rules that rely only on parsed form fields.

CVE-2026-42952: Charging station backend authentication throttling missing

  • Impact: Repeated login attempts can overwhelm the backend and cause a denial of service.
  • Affected Systems: Charging station backend authentication service.
  • Immediate Action: Enable rate limiting and lockout controls immediately; if unavailable, place the service behind a protective gateway or firewall rule.
  • Mitigation: Apply the vendor fix when released and monitor for bursts of failed authentication attempts.

CVE-2026-55175: Spinnaker Kustomize bake unsafe YAML tag processing

  • Impact: Unsafe YAML tag handling can lead to remote code execution on rosco pods during Kustomize bakes.
  • Affected Systems: Spinnaker versions prior to 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4.
  • Immediate Action: Upgrade immediately and suspend Kustomize bake operations if you cannot patch right away.
  • Mitigation: Move to the fixed release for your branch; restrict who can submit bake manifests and inspect rosco pod activity.

What to Do Now

  1. Patch or isolate first: Prioritize OpenPLC, charging-station services, and Spinnaker control planes. If patching is not immediate, restrict exposure at the network boundary.
  2. Verify exposure: Confirm which systems run affected versions, which endpoints are internet-facing, and whether legacy web UIs, websocket services, or bake workflows are enabled.
  3. Check for abuse: Review authentication logs, file-write activity, unusual compilation jobs, and rosco pod events for signs of exploitation.
  4. Harden temporarily: Disable unused features, enforce admin-only access, and add rate limits and firewall rules where available.

Verification steps: Compare installed versions against the fixed releases listed above, validate that no unauthorized files were written to runtime directories, and confirm WAF rules still detect multipart attacks after updating.

Monitoring recommendations: Alert on new files in OpenPLC runtime paths, unexpected websocket connections, spikes in failed logins, abnormal Spinnaker bake activity, and any rosco pod restarts or shell-like behavior.

Related Resources

  • Internal blog post: “Today’s Critical Exposure Review” — to be published.
  • Official vendor advisories: OpenPLC Runtime, charging station vendor notice, Spinnaker release notes, and ModSecurity 3.0.16 advisory.

Keep reading