CVE-2026-8024 is a critical (CVSS 9.8) deserialization of untrusted data flaw in iba AG industrial data software. A remote unauthenticated attacker may gain full access. Update to ibaPDA 8.14.0, ibaDatCoordinator 4.0.7 or ibaLogic 5.7.3, or later, and restrict network access.
What's affected
- Products: ibaPDA, ibaDatCoordinator and ibaLogic from iba AG. The record names the first two, and the advisory added ibaLogic on 2 September 2026.
- Affected: ibaPDA before 8.14.0, ibaDatCoordinator before 4.0.7, ibaLogic before 5.7.3.
- Fixed: ibaPDA 8.14.0, ibaDatCoordinator 4.0.7 and ibaLogic 5.7.3.
- Weakness: CWE-502, deserialization of untrusted data.
- CVSS 9.8 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Not listed in CISA KEV. The advisory credits researchers from Tenable with the report.
How to check if you're exposed
Check the version in each application's about dialog or in your software inventory, and compare it with the fixed versions. These tools usually run on Windows servers in plant networks, so include engineering workstations and data acquisition servers.
Then check network exposure. The vendor's mitigation is to restrict connections to localhost, so also look at Windows Firewall inbound rules for the client and server ports of these services. Any rule that allows other hosts to connect is worth reviewing.
What to do now
- Find every ibaPDA, ibaDatCoordinator and ibaLogic install.
- Update to ibaPDA 8.14.0, ibaDatCoordinator 4.0.7 and ibaLogic 5.7.3, or later.
- If you cannot update yet, apply the vendor mitigation: restrict connections to localhost. For ibaPDA, deactivate the option that automatically opens ports in Windows Firewall, then replace the incoming rules with manual ones for the connections you need.
- For ibaLogic, set the incoming rule named ibaLogic 5 remoting Connection to block.
- After any change, check that data acquisition still works, as the advisory advises.
Why it matters
The advisory says the applications do not properly restrict the .NET BinaryFormatter when deserializing client and server input. That can cause a type confusion and arbitrary code execution, running under the service user account. Microsoft documents BinaryFormatter as unsafe for untrusted data.
Industrial software often lives on flat networks and runs for years. The lesson is simple. Where a service speaks a binary protocol, firewall it, patch it and never let untrusted hosts connect.
Quick check
Is there a mitigation if I cannot update?
Yes. iba AG recommends restricting connections to localhost with firewall rules, then verifying data acquisition.
Sources
Last reviewed: 19 October 2026.
