OpenPLC Runtime v3 Gets No Fix for a Session-Hijack Flaw

An attacker who gets an OpenPLC Runtime v3 operator to click a crafted link can hijack that operator's session and issue commands to the programmable logic controller behind it, under a flaw CISA disclosed Sept. 22, 2026, that the project's maintainer says it will not fix.

CISA's advisory names a 6.1 score and two reporters

The advisory, ICSA-26-265-09, assigns CVE-2026-88020 a CVSS 3.1 score of 6.1, medium severity, for a cross-site scripting weakness in how the web interface routes programs based on a query-string parameter it does not encode. CISA credits Rajivarnan R. and Shirshak of the firm Secnora with reporting it. Successful exploitation, the advisory says, "could allow an attacker to hijack session cookies and issue state-changing requests as an operator," which for a PLC means the ability to alter what the physical process it controls actually does.

There is no patch, only a different codebase

OpenPLC Runtime v3 reached end of life and "is no longer maintained," according to a notice at the top of its own GitHub repository, which carries 1,600 stars and 609 forks. Vendor Autonomy Logic's only remediation is a full upgrade to OpenPLC Runtime v4, a separate codebase hosted under a different repository. CISA's interim mitigation is the one it gives for most unpatched ICS bugs: keep the device off the public internet, isolate it behind a firewall, and require a VPN for remote access.

OpenPLC Runtime	Status	Fix available
v3 (CVE-2026-88020)	End of life, unmaintained	None; upgrade only
v4	Current, actively maintained	N/A, not affected

A low-cost controller with a wide footprint

OpenPLC describes itself as a low-cost industrial automation platform meant for both real deployments and cybersecurity research, and CISA's advisory lists Critical Manufacturing, Energy, Transportation Systems and Water and Wastewater Systems as sectors where it is used worldwide. The precondition that limits the flaw's reach is the CVSS vector's UI:R marker: it requires an operator to interact with something an attacker controls, such as a malicious link, rather than working against an idle system on its own. A 6.1 score is not the same as an unreachable one; a phishing email sent to a single plant operator with the CISA advisory's browser open is enough to trigger it, since the query parameter it abuses lives in the same web interface that operator would already be using to route programs to the controller.

CVE-2026-88020's full vector, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, rates both confidentiality and integrity impact low and availability impact none. That distinction matters for triage: the flaw cannot by itself take a controller offline, only leak session data and let an attacker issue whatever state-changing web requests the hijacked operator session is already authorized to make.

OpenPLC's no-patch situation is not unique this month. Hitachi Energy also disclosed a flaw, rated 9.9, with no fixed version yet available, and CISA separately published an authentication-bypass advisory for Siemens Reyrolle relays in the same stretch of September ICS advisories.

CISA's advisory carries no federal patching deadline, unlike the three-day windows it has set this month for flaws confirmed as actively exploited, because OpenPLC Runtime v3 is not known to be exploited yet. For an operator still running it, the only way off the flaw is the v4 migration Autonomy Logic has been recommending since the older runtime's end of life.