Vulnerability · Published May 12, 2026 · Assigned by CERTVDE
CVE-2026-35227Improper resource management in CODESYS Modbus TCP Server
High 8.2
In plain English
A high-severity security flaw in CODESYS Modbus from CODESYS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS 4.0)8.2High
Exploit odds (30 days)0.4%top 71.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS Modbus TCP Server stack if a race condition in connection handling is successfully exploited, preventing legitimate clients from establishing new connections.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CODESYS | CODESYS Modbus | 1.0.0.0 – before 4.6.0.0 |
Weakness: CWE-772 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N