What’s Vulnerable › Vulnerabilities

CVE-2026-32666: Automated Logic WebCTRL Premium Server Authentication Bypass by Spoofing

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-21 · updated 2026-06-17
• Weakness: CWE-290

Description

WebCTRL systems that communicate over BACnet inherit the protocol's lack of network layer authentication. WebCTRL does not implement additional validation of BACnet traffic so an attacker with network access could spoof BACnet packets directed at either the WebCTRL server or associated AutomatedLogic controllers. Spoofed packets may be processed as legitimate.

Affected products

• Automated Logic WebCTRL Premium Server: before v8.5 — fixed in v8.5

How to fix

Upgrade to a fixed version: Automated Logic WebCTRL Premium Server v8.5. Check the vendor advisory for mitigations.

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json
• https://www.automatedlogic.com/en/company/security-commitment/
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08

Get alerted when CVE-2026-32666 or the next vulnerability affects your stack