CVE-2026-4769 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-4769 | CVSS 9.8 (Critical) | Exploit: PoC available

What Is It

CVE-2026-4769 is an unauthenticated remote access vulnerability affecting WAGO System I/O Field series devices, caused by an undocumented internal diagnostic interface that is briefly exposed during the device boot sequence.

Technical Detail

During the initial startup sequence, affected WAGO System I/O Field devices activate an internal diagnostic capability that is not documented in any official product materials and requires no authentication to access. An unauthenticated remote attacker who can reach the device on the network during this transient boot window can interact directly with internal system processes before normal access controls are enforced. Successful exploitation results in full system compromise, which in the context of industrial I/O field devices may include unauthorized control of connected operational technology processes.

Exploitation Status

A proof-of-concept exploit is publicly available. This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed in-the-wild exploitation has been reported as of July 13, 2026. The existence of a public PoC lowers the barrier for exploitation and increases the likelihood of opportunistic attempts, particularly given the critical CVSS score of 9.8.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been established for this vulnerability as of the date of this briefing.

What To Do

Apply any vendor-issued firmware patches from WAGO immediately, prioritizing internet-exposed or network-accessible System I/O Field devices. Where patching cannot be applied immediately, restrict network access to affected devices using firewall rules or network segmentation to prevent unauthenticated connections during device boot cycles. If possible, implement monitoring or alerting for unexpected inbound connections to WAGO device management ports during reboot events, which may serve as a detection signal for exploitation attempts. Organizations operating these devices in OT or ICS environments should review whether devices are reachable from untrusted network segments and isolate them accordingly. Contact WAGO directly for product-specific remediation guidance if no public patch is yet available.