OpenPLC v3 Authenticated Arbitrary File Write to RCE (CVE-2026-14480)

Technical Analysis

CVE-2026-14480 (CVSS 3.1: 9.9, CVSS 4.0: 8.7) is an External Control of File Name or Path vulnerability (CWE-73) in OpenPLC Runtime v3's legacy web UI. The application stores the attacker-supplied 'prog_file' value directly into the Programs.File database field and uses it as the write destination without validation; since Python's os.path.join() honors absolute paths supplied by the attacker, an authenticated low-privilege user can write files to any location writable by the webserver process. Because the OpenPLC build pipeline auto-compiles all .cpp files in the runtime core directory, an attacker can drop a malicious source file that gets compiled and executed as the OpenPLC runtime user when an operator triggers a normal program compile/run cycle, yielding full native code execution on the control system host. OpenPLC v3 is end-of-life with no patches available; CISA and the vendor recommend migration to OpenPLC v4. This is an OT/ICS-specific vulnerability with no direct AI agent tool-chain exposure, though organizations running AI-driven OT monitoring or automation agents that interact with OpenPLC hosts should ensure those agents do not hold credentials capable of triggering program uploads/compilation, as compromise of the runtime host could pivot into any co-located agent infrastructure or shared credential stores.

Affected Systems

OpenPLC v3 (all versions) — OpenPLC Runtime, legacy web UI program-upload feature; end-of-life product with no further patches.

Indicators of Compromise

• No known public exploitation reported at time of advisory; no specific hashes, IPs, or domains provided.

Remediation Steps

1. 1

   Upgrade to OpenPLC v4

   OpenPLC v3 is end-of-life and will not receive security patches. Migrate all deployments to OpenPLC v4 as recommended by the vendor.

2. 2

   Restrict network exposure

   Ensure OpenPLC web UI and control system devices are not accessible from the internet; place them behind firewalls isolated from business networks.

3. 3

   Enforce strong authentication and access control

   Since exploitation requires authentication, limit and monitor accounts with program-upload privileges, use strong unique credentials, and disable unused accounts.

4. 4

   Use secure remote access

   If remote access is required, use up-to-date VPN solutions rather than direct exposure of the OpenPLC interface.

5. 5

   Monitor for anomalous file writes and compilations

   Audit the OpenPLC runtime core directory for unauthorized .cpp file additions and monitor compilation/build events for unexpected triggers.

6. 6

   Follow CISA ICS defense-in-depth guidance

   Implement network segmentation, monitoring, and incident reporting practices per CISA's ICS recommended practices.