CVE-2026-88020

Name of the Vulnerable Software and Affected Versions Autonomy Logic OpenPLC version 3

Description An improper neutralization of input during web page generation occurs in the web interface when routing programs based on a query string parameter that is not encoded. This cross-site scripting (XSS) flaw allows attackers to steal session cookies and hijack operator sessions, enabling them to issue commands and gain control over programmable logic controllers and connected physical processes. The issue is present in systems deployed across critical manufacturing, energy, transportation, and water/wastewater sectors. Attackers may use this to pivot across operational technology (OT) networks via unencrypted east-west traffic flows.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Implement runtime segmentation to contain lateral movement within industrial environments.