CVE-2026-28205 is an initialization with insecure default flaw in OpenPLC_V3 that can let an attacker bypass authentication through an API. NVD scores it 9.8. CISA says all versions are affected and that OpenPLC_V3 is now end of life, so the recommended action is to move to OpenPLC Runtime v4.
What's affected
CISA's ICS advisory ICSA-25-345-10 (updated 9 April 2026) lists all versions of OpenPLC_V3 as known affected for this CVE. There is no fixed version in the 3.x line, because the vendor remediation is a mitigation, not a patch: OpenPLC_v3 is now considered end of life, and users are recommended to upgrade to OpenPLC Runtime v4.
CISA scores this CVE at 8.9 under CVSS v3.1 with high attack complexity and a changed scope. NVD's score for the record is 9.8. The weakness is CWE-1188 (Initialization of a Resource with an Insecure Default).
The same advisory covers three other OpenPLC_V3 CVEs, including cross-site request forgery, plaintext password storage and a missing authorization check in a REST endpoint. CISA's summary of the combined impact is alteration of PLC settings, upload of malicious programs, access to credentials, or authentication bypass.
The advisory lists these sectors: Critical Manufacturing, Energy, Transportation Systems, and Water and Wastewater.
How to check if you're exposed
Inventory first. Find every system running OpenPLC_V3, including lab, test and pilot installs that are easy to forget. Search your asset list, your container registry for OpenPLC images, and your network for the web interface.
Then work out reachability. Which of those hosts can be reached from a network that includes untrusted users or the internet? CISA's standing guidance for control systems is to keep them off the internet and behind firewalls, with remote access through a VPN that is itself kept current.
What to do now
- Plan a migration from OpenPLC_V3 to OpenPLC Runtime v4, the replacement named in the CISA advisory.
- Until you migrate, remove any internet exposure and put the interface behind a firewall and a VPN.
- Limit which accounts and hosts can reach the OpenPLC API at all.
- Rotate any credentials that were stored by or used with an affected install, because the same advisory notes plaintext password storage in another CVE.
- Take a verified backup of your PLC programs and settings before changing anything, and test the migration off the production network first.
- Follow CISA's recommended practices for control systems: minimise network exposure, isolate control networks from business networks, and review the advisory for updates.
Why it matters
An insecure default means the product is shipped in a state that is not safe, and users get that state unless they change it. In this record the unsafe state lets an API bypass authentication. The effect is that a person who should be asked to log in is not.
Industrial controllers raise the stakes. A web login on a blog guards content. A login on a PLC guards the logic that drives physical equipment, which is why CISA lists impacts like altering PLC settings and uploading malicious programs.
The decisive fact here is the lifecycle. When a project is end of life, there will be no 3.x patch to wait for, so the fix is a migration, which takes planning. Teams that start the inventory now will have the time to do it carefully.
The record does not flag exploitation in the wild, and the CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Is there a patch for OpenPLC_V3?
CISA's advisory does not list one. It says OpenPLC_v3 is end of life and recommends upgrading to OpenPLC Runtime v4.
What does the insecure default mean in plain words?
The software ships in a state where an API can be used to get past authentication, and the user gets that state unless something changes it. Check the CISA advisory for the vendor's guidance.
Sources
Last reviewed: 19 October 2026.
