CVE-2026-6284 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-6284 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-6284 is a weak authentication vulnerability affecting a Programmable Logic Controller (PLC) that is network-accessible, where insufficient password complexity requirements and the absence of brute-force rate limiting allow an attacker to enumerate valid credentials and gain unauthorized access.

Technical Detail

The flaw exists in the PLC's authentication mechanism, which enforces no meaningful constraints on password complexity and imposes no lockout or throttling policy on repeated login attempts. An attacker with network-level access to the device can systematically brute-force credentials until a valid password is discovered, resulting in unauthorized access to the PLC's systems and services. Depending on the device's role in an operational environment, successful exploitation could enable configuration tampering, process manipulation, or disruption of industrial control functions, with potential consequences ranging from service interruption to physical process impact.

Exploitation Status

No known exploit code has been publicly identified for this vulnerability at this time, and it is not currently listed in CISA's Known Exploited Vulnerabilities catalog. The attack technique required, credential brute-forcing, is low-complexity and requires no specialized tooling, meaning the practical barrier to exploitation is minimal for any attacker with network access to the affected device.

Who Is Targeting This

No specific threat actor attribution has been confirmed at this time. However, vulnerabilities in network-accessible PLCs are historically of interest to both nation-state actors targeting critical infrastructure and opportunistic actors conducting broad industrial control system reconnaissance. No campaigns leveraging this specific CVE have been identified as of April 24, 2026.

What To Do

Immediately restrict network access to the affected PLC using firewall rules, network segmentation, or access control lists to limit exposure to trusted hosts only. If the device supports it, enforce strong password policies and enable any available account lockout or login attempt throttling features. Operators should audit current credentials on affected devices and replace any weak or default passwords with long, complex alternatives. Monitor authentication logs for repeated failed login attempts as a detection signal for active brute-force activity. Consult the vendor for firmware updates or patches that introduce native brute-force protections, and prioritize patching given the critical CVSS score of 9.1 and the low technical barrier to exploitation.