External risk intelligence

Open62541 Null Pointer Dereference in AddReferences Affects Server Operation.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-67870

open62541 is an OPC UA implementation typically used in industrial automation, SCADA systems, and IoT devices. While these systems are primarily deployed within internal operational technology (OT) or manufacturing networks, some instances may be exposed to the internet or reachable via gateways, making remote access possible though not the standard configuration for this protocol.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects the open62541 library, which is used in industrial automation and IoT systems. An attacker could exploit this flaw to gain unauthorized access and potentially impact system operations. The main concern is to confirm if this technology is used within your environment and if it is exposed in a way that makes it reachable.

Unhandled server error allows unauthorized access.
Critical system technology requires awareness.
Confirm use and exposure for risk assessment.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to a vulnerable server. This request targets the server's handling of references between data points, specifically when adding new references. By manipulating certain fields within this request, an attacker can cause the server to crash or behave unexpectedly. This could potentially allow an attacker to disrupt the service or gain unauthorized access to information.

No authentication required.
Triggers with malformed AddReferencesRequest.
Leads to server crash or data compromise.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could exploit a flaw in how certain targets are handled, potentially leading to a NULL pointer dereference when executing server-side operations. This could affect the availability and integrity of the service.

Server-side operational data.
Malformed requests sent remotely.
Service disruption and data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for industrial control systems, IoT platforms, or specific application deployments using the affected OPC UA implementation should lead the response. The first practical move is to identify all instances of the technology, confirm their reachability and criticality to operations, and then assign ownership for remediation.

Ownership is with the system or application owner.
Verify system exposure and business criticality first.
Plan remediation based on identified risks.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is open62541?

open62541 is an open-source software library that implements the OPC UA (Open Platform Communications Unified Architecture) protocol. It provides the building blocks for creating servers and clients in industrial automation, SCADA systems, and IoT devices, allowing these machines to exchange data securely and reliably across manufacturing or operational environments.

What is the vulnerability in CVE-2026-67870?

This CVE involves a software weakness known as CWE-476, or a NULL pointer dereference. In the affected version of open62541, the server fails to properly validate certain data fields when processing an AddReferences request. Because the software does not check these fields, it attempts to use a memory address that was never assigned, leading to unexpected behavior or a system crash.

How can an attacker trigger this bug?

An attacker triggers this flaw by sending a specifically crafted 'AddReferencesRequest' to the server. To activate the bug, the request must include an empty 'targetServerUri' alongside a non-zero 'targetNodeId.serverIndex'. Requests that provide valid, populated values for these fields will not trigger this specific memory error, as the server expects complete data to process the reference properly.

Is my system at risk if it is not internet-facing?

According to Halo Surface Signal, open62541 is typically deployed within internal operational technology or manufacturing networks. While remote access via the internet is possible through gateways, internal-only systems remain at risk if an attacker has already gained access to the local network where the OPC UA server is reachable.

What should I do first to manage this CVE?

Start by performing an inventory to identify all systems in your environment that utilize the open62541 library. Once identified, evaluate their criticality to your operations and check how they are networked. After mapping your exposure, coordinate with the relevant application or system owners to prioritize and plan for necessary updates to secure your deployment.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.