External risk intelligence

OpenPLC Runtime Arbitrary File Write via Crafted Structured Text Programs Enabling Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-71268

OpenPLC Runtime includes a webserver component used for uploading and compiling program files. This functionality serves as an interface for management and configuration, and such web-based portals are commonly exposed to the network to allow authorized users to manage industrial control processes remotely.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in OpenPLC Runtime's file handling, allowing attackers to execute arbitrary code on affected systems. The issue stems from improper validation of file paths within program files uploaded to the system, which could lead to unauthorized modifications and potentially compromise industrial control processes. Hardcoded default credentials further reduce the difficulty of exploiting this vulnerability.

Unauthorized code execution is possible through uploaded files.
Exploitation could impact industrial control systems.
Confirm if OpenPLC Runtime is in use and exposed.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by uploading a specially crafted Structured Text program file to the OpenPLC Runtime's web interface. This file, when compiled, allows the attacker to write arbitrary content to any location on the filesystem, potentially leading to remote code execution by manipulating system files. The vulnerability is further exacerbated by the use of hardcoded default credentials, making it easier for an attacker to gain the necessary initial access.

Requires authenticated access to the web interface.
Triggered by uploading a malicious program file.
Enables arbitrary file writes and remote code execution.

Live Threat

Current exploitation, exposure, and threat context

OpenPLC Runtime's compile_program() function could allow an attacker to write arbitrary content to any location on the filesystem when processing specially crafted Structured Text files. This could lead to the execution of malicious code by overwriting system files or configuration entries.

Arbitrary file writes to filesystem.
Unvalidated file path in program upload.
Remote code execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-World Ownership

The OpenPLC Runtime's compile_program() function is vulnerable to arbitrary file writes due to insufficient path validation when processing Structured Text files, potentially leading to remote code execution. Teams responsible for managing the PLC environment, including platform or infrastructure owners and security teams, should prioritize this. The initial step involves identifying all instances of OpenPLC Runtime, assessing their network exposure and business criticality, and then determining the accountable owner for remediation planning.

Platform or security teams own remediation.
Verify exposed OpenPLC Runtime instances.
Plan remediation and coordinate vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenPLC Runtime?

OpenPLC Runtime is an open-source software platform used to automate and manage industrial control processes. It includes a built-in webserver that allows users to remotely upload and compile Structured Text (.st) program files, which dictate how industrial hardware operates.

What is the vulnerability in CVE-2026-71268?

This vulnerability is a path traversal flaw, classified as CWE-22. It occurs because the software fails to properly sanitize file paths when processing uploaded program files. As a result, the system can be tricked into writing files to unauthorized locations on the server's filesystem instead of the intended directory.

How does an attacker trigger this CVE-2026-71268 bug?

An attacker triggers this by uploading a malicious Structured Text file containing specially crafted file directives. It is important to note that simply visiting the web interface does not trigger the bug; the attacker must successfully upload and initiate the compilation process for the malicious file to execute the write operation.

Who should be concerned about this vulnerability?

Anyone running OpenPLC Runtime, especially if the web interface is reachable over a network, should be concerned. According to Halo Surface Signal, these web-based portals are frequently exposed to manage processes remotely, which significantly increases the risk of unauthorized access and potential system compromise.

How do I secure my environment against this?

Begin by identifying all instances of OpenPLC Runtime within your infrastructure to assess their exposure. Ensure default credentials are changed immediately to prevent unauthorized access. Coordinate with your technical or security teams to verify these assets and plan for necessary software updates or configuration changes to mitigate the risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.