CVE-2025-41726 HIGH

CVE-2025-41726: Beckhoff: Arbitrary code execution within privileged processes

Vendor Beckhoff Automation
Product Beckhoff.Device.Manager.XAR
Weakness CWE-190
Published January 27, 2026
Last update January 27, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes.

Key dates

02Disclosure timeline

January 27, 2026 CVE published
January 27, 2026 Record updated