What’s Vulnerable › Products

CODESYS Runtime Toolkit vulnerabilities

28 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your CODESYS Runtime Toolkit version is affected

Latest CODESYS Runtime Toolkit vulnerabilities

• CVE-2026-76992 — Uncontrolled Memory Allocation in CODESYS Gateway Client (CVSS 7.5)
• CVE-2026-79625 — Improper Synchronization in Monitoring in CODESYS Control Runtime (CVSS 8.1)
• CVE-2025-41738 — CODESYS Control - Invalid type usage in visualization (CVSS 7.5)
• CVE-2025-41659 — CODESYS Control PKI Exposure Enables Remote Certificate Access (CVSS 8.3)
• CVE-2025-41658 — CODESYS Toolkit Exposes Sensitive Files via Default Permissions (CVSS 5.5)
• CVE-2024-5000 — CODESYS: Incorrect calculation of buffer size can cause DoS on CODESYS OPC UA products (CVSS 7.5)
• CVE-2023-6357 — OS Command Injection in multiple CODESYS products (CVSS 8.8)
• CVE-2022-4224 — CODESYS: Exposure of Resource to Wrong Sphere in CODESYS V3 (CVSS 8.8)
• CVE-2022-32143 — CODESYS runtime system prone to directory acces (CVSS 6.5)
• CVE-2022-32142 — CODESYS runtime system prone to denial of service due to use of out of range pointer (CVSS 5.5)
• CVE-2022-32141 — CODESYS runtime system prone to denial of service due to buffer over read (CVSS 4.0)
• CVE-2022-32140 — CODESYS runtime system prone to denial of service due to buffer copy (CVSS 4.0)
• CVE-2022-32139 — CODESYS runtime system prone to denial of service due to out of bounds read (CVSS 4.0)
• CVE-2022-32138 — CODESYS runtime system prone to denial of service due to Unexpected Sign Extension (CVSS 6.5)
• CVE-2022-32137 — CODESYS Runtime System prone to heap based buffer overflow (CVSS 6.5)
• CVE-2022-32136 — Codesys runtime systems: Access of uninitialised pointer lead to denial of service. (CVSS 6.5)
• CVE-2022-31806 — Insecure default settings in CODESYS Runtime Toolkit 32 bit full and CODESYS PLCWinNT (CVSS 6.8)
• CVE-2022-31805 — Insecure transmission of credentials (CVSS 4.3)
• CVE-2022-1965 — CODESYS runtime system prone to file deletion due to improper error handling (CVSS 5.5)
• CVE-2021-34596 — CODESYS V2 runtime: Access of Uninitialized Pointer may result in denial-of-service (CVSS 6.5)
• CVE-2021-34595 — CODESYS V2 runtime: out-of-bounds read or write access may result in denial-of-service (CVSS 8.1)
• CVE-2021-34593 — CODESYS V2 runtime: unauthenticated invalid requests may result in denial-of-service (CVSS 5.0)
• CVE-2021-33486 — (CVSS 7.5)
• CVE-2021-30195 — (CVSS 7.5)
• CVE-2021-30186 — (CVSS 7.5)