VulnSocial

CVE-2026-88020Disclosure

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 5 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 5 signals
  • Disclosure: 4 classified signals
  • Peaked 2d ago at 3 mentions (2026-09-22); latest day: 1
  • 5 total mentions across 3 days

Deep dive

Activity timeline5 mentions / 3d
01223Mentions · 2026-09-22: 3Mentions · 2026-09-23: 1Mentions · 2026-09-28: 1Patch / Workaround · 2026-09-23: 1Technical Details · 2026-09-22: 3Technical Details · 2026-09-23: 1Technical Details · 2026-09-28: 109-2209-2309-28
Signal classification2 categories
Disclosure
480.0%
Patch
120.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-09-223
Disclosure3
2026-09-231
Patch1
2026-09-281
Disclosure1
Full discourse5 posts
  • SHELLCODE@sh3ll_c0d3
    Disclosure

    🏭 PHYSICAL PROCESS SABOTAGE: OpenPLC Runtime Session Hijack! ⚡⚠️ CVE-2026-88020 input bug allows remote attackers to hijack SCADA sessions and overwrite industrial ladder logic. 👉 Full analysis: https://sh3llc0d3.com/blog/hacking-the-open-source-plc-cisa-warns-session-hijacking-in-openplc-runtime-allows-physical-process-sabotage/ #sh3llc0d3 #shellcode #OTSecurity #OpenPLC #SCADA

    Post summary

    The tweet announces CVE-2026-88020 as an input bug enabling remote SCADA session hijacking and ladder logic overwriting, providing technical vulnerability details without naming a patch, exploit tool, or evidence of active wild exploitation.

    0000047
    108 followersView on X
  • CyberWorldOps@CyberWorldOps
    Patch

    CISA warns CVE-2026-88020 XSS in OpenPLC Runtime v3 could let attackers steal sessions and control PLCs and physical processes. Patch and isolate OT web interfaces. #ICSsecurity #CVE #OpenPLC https://cyberworldops.eu/en/openplc-web-flaw-could-turn-a-stolen-session-into-industrial-process

    Post summary

    CISA warns of CVE-2026-88020 XSS in OpenPLC Runtime v3 and urges patching and isolation of OT web interfaces.

    0000034
    13 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-88020 Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the p… https://www.cve.org/CVERecord?id=CVE-2026-88020

    Post summary

    The post announces CVE-2026-88020 for Autonomy Logic OpenPLC 3, describing an input neutralization flaw in the web interface and linking to the official CVE record, without mentioning exploits, patches, or active exploitation.

    000001.1K
    58.1K followersView on X
  • NewsTongue@NewsTongueX
    Disclosure

    🔴 OpenPLC Runtime v3 flaw lets attackers hijack operator sessions, control industrial systems A cross-site scripting vulnerability (CVE-2026-88020) in OpenPLC Runtime v3 allows attackers to steal session cookies and issue commands as an operator, gaining control over programmable logic controllers and their connected physical processes. The vulnerability stems from improper input neutralization in the web interface's query string routing, leaving it unencoded. • Affected: OpenPLC v3 deployed worldwide in critical manufacturing, energy, transportation, and water/wastewater systems • Vendor: Autonomy Logic (US-based)

    Post summary

    The text discloses a cross-site scripting vulnerability (CVE-2026-88020) in OpenPLC Runtime v3, detailing its technical mechanism and potential impact on operational technology systems, without mentioning a PoC or patch.

    0000033
    926 followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Disclosure

    TRC analysis reveals CVE-2026-88020 XSS vulnerability in OpenPLC Runtime v3 enables session hijacking and operator privilege escalation in industrial control systems. Attackers can pivot across OT networks through unencrypted east-west traffic flows. Runtime segmentation helps contain post-compromise lateral movement in industrial environments. #ICS #ZeroTrust 🔗 Full breakdown: https://aviatrix.ai/threat-research-center/openplc-runtime-v3-cve-2026-88020-xss-vulnerability

    Post summary

    The text announces and provides technical details about the CVE-2026-88020 XSS vulnerability in OpenPLC Runtime v3, focusing on its potential for session hijacking and privilege escalation in industrial control systems, without detailing exploits or patches.

    0000046
    2.0K followersView on X

Explore more

Back to dashboard