CISA Warns of Cross-Site Scripting Vulnerability in OpenPLC Runtime v3

The Cybersecurity and Infrastructure Security Agency (CISA) has published Industrial Control Systems Advisory icsa-26-265-09, disclosing a Cross-site Scripting vulnerability in Autonomy Logic OpenPLC Runtime v3. The vulnerability, tracked as CVE-2026-88020, stems from improper neutralization of input during web page generation when the web interface routes program logic based on a query string parameter with no encoding.

Successful exploitation could allow an attacker to hijack session cookies and issue state-changing requests as an operator, which would allow the attacker to control the programmable logic controller and the physical processes it drives. Affected sectors include Critical Manufacturing, Energy, Transportation Systems, and Water and Wastewater Systems, with deployments worldwide.

The CVSS score for this vulnerability is 6.1 (Medium severity) under CVSS v3.1, with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. A CVSS score of 5.3 (Medium) is assigned under CVSS v4.0.

Autonomy Logic notes that OpenPLC Runtime v3 is end-of-life and is no longer receiving patches, bug fixes, or security updates. The vendor recommends that users upgrade to OpenPLC v4 to mitigate the vulnerability. CISA recommends minimizing network exposure for all control system devices, ensuring they are not accessible from the internet, and locating control system networks and remote devices behind firewalls, isolating them from business networks. When remote access is required, CISA advises using more secure methods such as Virtual Private Networks (VPNs), updated to the most current version available. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. The vulnerability was reported to CISA by researchers Rajivarnan R. and Shirshak of Secnora.