noindex and left out of the sitemap until more data is confirmed.CVE-2026-88020 is a reflected cross-site scripting flaw in Autonomy Logic's OpenPLC Runtime v3 web interface: an unencoded query-string parameter used to route program pages lets an attacker hijack an operator's session and issue state-changing requests, potentially gaining control of the PLC and the physical process it drives; NVD has not yet completed its own CVSS scoring or CPE mapping, so this page stays noindex until that analysis is published.
Vulnerability summary
N/A
Not yet scored
0.3%
EPSS score (FIRST)
No
CISA KEV catalog
2026-09-22
Published
Vulnerability ID: CVE-2026-88020 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Autonomy Logic OpenPLC Runtime | — | v3 (all versions, end-of-life; vendor recommends migrating to v4, which is unaffected); not yet a published NVD CPE applicability statement |
What this means
CVE-2026-88020 is an improper neutralization of input during web page generation vulnerability (CWE-79, cross-site scripting) in OpenPLC Runtime v3, an open-source programmable logic controller runtime from Autonomy Logic widely used in manufacturing, energy, transportation and water/wastewater systems. CISA's advisory states the product contains "an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding," and that "successful exploitation of this vulnerability could allow an attacker to hijack session cookies and issue state-changing requests as an operator which would allow the attacker to control the programmable logic controller and the physical processes it drives" (CISA ICS Advisory ICSA-26-265-09).
NVD tracks the CVE with status "Awaiting Analysis" as of 2026-10-27: it records a CNA-submitted (ICS-CERT) CVSS v3.1 score of 6.1 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, and a CVSS v4.0 score of 5.3 (medium), but NVD has not published its own independent score or a CPE applicability statement, so this page leaves cvss_score unset rather than presenting the CNA figure as NVD-confirmed (NVD).
CISA's advisory ICSA-26-265-09, published 2026-09-22, credits researchers Rajivarnan R. and Shirshak of Secnora with the report and states that Autonomy Logic "recommends users upgrade to OpenPLC v4 as OpenPLC v3 is end-of-life and is no longer receiving patches, bug fixes, or security updates" — meaning there is no patched v3 release, only migration to v4, which is unaffected. CISA states no known public exploitation has been reported to it at this time (CISA ICS Advisory ICSA-26-265-09).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-26, and FIRST scores the probability of exploitation at 0.00275 (19.8th percentile) as of 2026-10-26 (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity and applicability analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, because v3 is end-of-life with no vendor patch available, operators still running OpenPLC Runtime v3 should migrate to v4 or otherwise restrict and monitor access to the web interface.
Evidence
- An unencoded query-string parameter used to route program pages in OpenPLC Runtime v3's web interface enables reflected XSS, letting an attacker hijack an operator session and issue state-changing requests to control the PLC (CWE-79). — CISA ICS Advisory ICSA-26-265-09
- NVD status is "Awaiting Analysis" with a CNA (ICS-CERT) submitted CVSS v3.1 6.1 / v4.0 5.3, no NVD-published score or CPE configuration as of 2026-10-27. — NVD
- Affects OpenPLC Runtime v3 (all versions, end-of-life, no patch; v4 unaffected); reported by Rajivarnan R. and Shirshak of Secnora; no known public exploitation reported. — CISA ICS Advisory ICSA-26-265-09
- Not present in the CISA KEV catalog as of 2026-10-26. — CISA KEV
- EPSS score is 0.00275 (19.8th percentile) as of 2026-10-26. — FIRST EPSS
