CVE-2026-67869

No known exploitation. EPSS puts it in the 57th percentile. No fix published yet.

CVSS 3.17.5High EPSS percentile57th0.8% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Check it yourself

OpenVAS · 2 checks

e.g. OID 1.3.6.1.4.1.25623.1.1.9.2026.610091910197521

Run the check

Published 2026-08-05Updated 2026-08-31Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your systems use open62541 v1.5.5 and whether they expose its service to untrusted networks.
Ask your software supplier or development team for the vendor-supported fixed version; no fix version is currently available.
Until an update is available, restrict network access to the affected service to trusted systems only.
Watch for repeated failed or unusual service-call requests and unexpected service restarts.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Service_Call validates input arguments against runtime-resolved InputArguments metadata

In plain language

Written by AI from the record

open62541 v1.5.5 has a flaw that can let a remote attacker disrupt the service, so businesses using that version should investigate and plan mitigation.

A remotely reachable buffer overflow in open62541 v1.5.5 Service_Call input-argument validation can cause denial of service.

If you're affected

Service outages
Operational disruption
Device communication disruption

What is it

This is a software flaw that can make an affected service stop working when it receives a specially made request. It is like someone repeatedly jamming the entrance mechanism to a shop: they may not take anything, but they can prevent normal customers and staff from getting through.

Who is affected

This matters to you if you use or run open62541 v1.5.5, directly or inside a product supplied by another vendor. Ask your supplier if their equipment or application includes it. It is a risk if an attacker can reach the affected service over the network.

How urgent is it

No public evidence shows attackers are exploiting this flaw, but an attacker can use it remotely to interrupt an exposed service. Treat this as an amber priority: reduce unnecessary network access now and obtain a supplier remediation plan, especially for business-critical systems.

What to do — in detail

Confirm whether deployed applications or embedded products include open62541 v1.5.5, then identify listening endpoints and firewall paths that permit untrusted clients to send Service_Call requests. There is no published fixed version or supported upgrade target in the available findings, so obtain guidance from the project or the product vendor before changing versions. If patching is delayed, limit access to approved hosts using network segmentation, firewall allowlists, VPN access, or application-level access controls, and remove public exposure where it is not required. Monitor service availability, crash or restart events, and unusually frequent or malformed service-call requests. CVE-2026-67869 is not listed in CISA KEV, so no CISA remediation due date applies.

Technical context

CVE-2026-67869 is rated CVSS 7.5 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). It is a CWE-120 buffer overflow affecting open62541 v1.5.5, with the described trigger involving Service_Call validation against runtime-resolved InputArguments metadata; the reported impact is denial of service. It is not in CISA KEV, and no public exploit code is on record. EPSS predicts a 0.5% likelihood (39th percentile) and the trend is flat; this is a prediction, not evidence of exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS57th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.8% chance of exploitation activity in the next 30 days, which ranks it in the 57th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 44 days, from the signal feeds we watch.

2026-09-18OpenVAS check added
2026-08-31Record updated
2026-08-06Record updatedrecord updated
2026-08-05Publishedweakness classified, att&ck mapped, record updated

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity NoneNo integrity impact
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-120No name in the record

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

Initial AccessT1190Exploit Public-Facing Applicationhigh confidence
Privilege EscalationT1068Exploitation for Privilege Escalationhigh confidence

Sources

References in the record

And 1 more reference. See all after sign-in

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account