As cited
Copy frozen at (site build).
vulnerabilities
Re: CVE-2026-102508: Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade
Apache PLC4X versions 0.9.0 through 0.13.1 contain multiple vulnerabilities in OPC UA (OLE for Process Control Unified Architecture) secure channel implementation, including integrity bypass, unverifiable server certificates, and silent downgrade attacks. The issues are resolved in PLC4X 1.0.0 with no fix available for the 0.13.x branch. Attackers can exploit these flaws by impersonating servers or intercepting network traffic to compromise the client library.
Why it matters: Organizations using PLC4X for industrial control or operational technology environments must upgrade to version 1.0.0 immediately, as the library's OPC UA implementation can be compromised by malicious or network-adjacent attackers without detection.
- Source published
- First seen by Cybersecurity Tracker