CVE-2026-62927 is a high severity (CVSS 7.5) authorization bypass in the Eclipse Milo OPC UA server SDK. In versions 1.0.0 through 1.1.4, a client can run a method it is denied by batching it with one it is allowed. Version 1.1.5 lists a fix, so upgrade.
What's affected
The record says Eclipse Milo 1.0.0 through 1.1.4. The Eclipse CVE reservation gives the range as 1.0.0 up to but not including 1.1.5 and rates it 8.7 High on CVSS 4.0, while the record's CVSS 3.1 score is 7.5 High. The weakness is CWE-863 (incorrect authorization).
The Call service computes authorization for each call in a batch, then passes the original mixed batch to the address space handlers. A denied call that sits in the same batch as an allowed call is therefore dispatched anyway. The record says an anonymous or otherwise low privileged client can do this.
The v1.1.5 release notes include a change titled Call dispatch to authorized methods, which matches this issue. Confirm that entry against your own build before relying on it.
How to check if you're exposed
Milo is a Java library, so check the resolved dependency version.
mvn dependency:tree -Dincludes=org.eclipse.milo
./gradlew dependencies --configuration runtimeClasspath | grep eclipse.milo
If any Milo server module resolves to a version from 1.0.0 through 1.1.4, you are on an affected release. Then ask a second question: which methods does your server expose that an anonymous or low privileged user should not be able to call? Those are the methods at risk. The free in-browser dependency scan at gold.safeguard.sh/scan can list the matching dependencies in a manifest or lockfile you paste in.
What to do now
- Find every OPC UA server or gateway that embeds Eclipse Milo, including vendor products that bundle it.
- Upgrade the Milo server dependencies to 1.1.5 or later and rebuild.
- Disable anonymous access to the server if you do not need it.
- Review the access control rules for methods that change state, such as writes to equipment, and tighten them.
- Retest your access rules after the upgrade by trying a denied call, alone and inside a batch, in a test environment.
Why it matters
This is a classic check and use mismatch. The server decides what is allowed, but then acts on the original request instead of the filtered one. Anything that evaluates a request in one form and executes it in another is open to this mistake, and batch interfaces make it easy to write.
OPC UA is common in industrial settings, where a method call can change the state of equipment. That raises the stakes beyond a typical web application. The class is CWE-863. The record does not list this CVE as exploited in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is anonymous access required for exploitation?
The record says an anonymous or otherwise low privileged client. So the issue is most severe where anonymous sessions are allowed, but any low privileged account can be enough.
Sources
Last reviewed: 18 October 2026.
