CVE-2025-41726 Beckhoff: Arbitrary code execution within privileged processes
A low-privileged remote attacker can trigger integer overflows in Beckhoff Device Manager to execute arbitrary code in privileged processes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-41726?
CVE-2025-41726 is a high-severity vulnerability in Beckhoff.Device.Manager.XAR, published on 27 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes.
Weakness: CWE-190
Which versions are affected by CVE-2025-41726?
How do I fix CVE-2025-41726?
No fix has been published for CVE-2025-41726 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-41726 being exploited?
There is no known exploitation of CVE-2025-41726 in the wild and no public exploit code.
Sources
Also known as GHSA-8283-g649-xjrh.