What’s Vulnerable › Vulnerabilities

CVE-2026-32968: Unauthenticated RCE in com_mb24sysapi

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-23 · updated 2026-06-17
• Weakness: CWE-78

Description

Due to the improper neutralisation of special elements used in an OS command, an unauthenticated remote attacker can exploit an RCE vulnerability in the com_mb24sysapi module, resulting in full system compromise. This vulnerability is a variant attack for CVE-2020-10383.

Affected products

• Helmholz myREX24V2: through 2.19.3
• Helmholz myREX24V2.virtual: through 2.19.3
• MB connect line mbCONNECT24: through 2.19.3
• MB connect line mymbCONNECT24: through 2.19.3

References

• https://certvde.com/de/advisories/VDE-2026-024
• https://certvde.com/de/advisories/VDE-2026-025

Get alerted when CVE-2026-32968 or the next vulnerability affects your stack