Vulnerability · Published May 26, 2026 · Assigned by CERTVDE
CVE-2026-44469Incorrect Default Permissions in CODESYS Development System
High 7.8
In plain English
A high-severity incorrect default permissions in CODESYS Development System from CODESYS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Official description
The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileged local attacker can exploit a TOCTOU race condition with a practical time window to replace verified files with malicious ones before installation, resulting in local privilege escalation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CODESYS | CODESYS Development System | 3.0.0.0 – before 3.5.22.20 |
Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H