Is CVE-2026-88850 known to be exploited?

It is not marked known-exploited in this record.

CVE-2026-88850

Update WAGO OS Linux firmware to version 4.10.0 or higher. Contact WAGO support for custom firmware. Refer to product manuals for security recommendations specific to Controller PFC100/PFC200 products.

Quick answers

What is CVE-2026-88850?: Update WAGO OS Linux firmware to version 4.10.0 or higher. Contact WAGO support for custom firmware. Refer to product manuals for security recommendations specific to Controller PFC100/PFC200 products.
How severe is CVE-2026-88850?: high, CVSS 8.8
Is CVE-2026-88850 known to be exploited?: It is not marked known-exploited in this record.
How should CVE-2026-88850 be mitigated?: Update WAGO OS Linux firmware to version 4.10.0 or higher. Contact WAGO support for custom firmware. Refer to product manuals for security recommendations specific to Controller PFC100/PFC200 products.

CVSS

8.8

Vendor

WAGO

Published

Oct 21, 2026 · 02:13

Patch

Unknown / not confirmed

Affected products

WAGO Firmware >=1.0.0, <4.10.0 installed on WAGO Hardware 0751-9x01, WAGO Firmware >=1.0.0, <4.10.0 installed on WAGO Hardware 0750-811x, WAGO Firmware >=1.0.0, <4.10.0 installed on WAGO Hardware 0750-821x, WAGO Firmware >=1.0.0, <4.10.0 installed on WAGO Hardware 0762-420x, WAGO Firmware >=1.0.0, <4.10.0 installed on WAGO Hardware 0762-430x, WAGO Firmware >=1.0.0, <4.10.0 installed on WAGO Hardware 0762-520x, WAGO Firmware >=1.0.0, <4.10.0 installed on WAGO Hardware 0762-530x, WAGO Firmware >=1.0.0, <4.10.0 installed on WAGO Hardware 0762-620x, WAGO Firmware >=1.0.0, <4.10.0 installed on WAGO Hardware 0762-630x, WAGO Firmware >=1.0.0, <4.10.0 installed on WAGO Hardware 0752-8303, WAGO Firmware >=1.0.0, <4.10.0 installed on WAGO Hardware 0762-340x

Mitigation

WAGO OS Linux Vulnerabilities Allow Privilege Escalation via Web Management Interface

CISA has issued an Industrial Control Systems advisory (ICSA-26-293-02) disclosing two vulnerabilities in the Web-Based Management (WBM) interface of various WAGO controllers. The flaws, tracked as CVE-2026-80466 and CVE-2026-88850, affect WAGO OS Linux firmware versions prior to 4.10.0 across numerous hardware platforms. CVE-2026-80466 involves OS command injection through routing configuration, while CVE-2026-88850 involves missing authorization for PROFIBUS configuration management. Both vulnerabilities allow an authenticated low-privileged user to bypass intended privilege boundaries. WAGO recommends updating to firmware version 4.10.0 or higher.

12m

CVE-2026-88850

Quick answers

Related News

WAGO OS Linux Vulnerabilities Allow Privilege Escalation via Web Management Interface