A retired controller platform will not be patched, so the only fix is a migration.

The United States cyber agency published an advisory on 22 September for OpenPLC Runtime, free software that turns an ordinary computer into a programmable controller, the box that starts a pump or steps a conveyor along.

The defect sits in the web page operators use to run it. An attacker who persuades a logged-in operator to open a prepared link can take over that operator's session and issue instructions in their name, reaching the controller and the equipment behind it.

That is the flaw. The more useful fact is the answer to it. The affected line has reached the end of its supported life, so no patch is coming and none will. The supplier's remedy is a move to the current generation of the software, which is a project rather than an update.

The agency lists critical manufacturing, energy, transport, and water and wastewater among the sectors where this software runs, and it is deployed worldwide. If someone at your site put it on a pilot rig, a training bench, a small pump station or a low-cost retrofit, that is the person to forward this to.

What it means where the plant is

Free controller software turns up where a commercial controller was not in the budget: a scheme run by a small municipality, a pilot line, a retrofit on plant that predates the current standard, a proof of concept somebody built that quietly became production. None of that is in an advisory. It is in the asset register, if it reached the asset register at all.

The management interface is the part that matters. It is how the control logic gets loaded, started and stopped. Taking over an operator's signed-in session means acting with that operator's rights, as far as changing what the controller is doing to the physical process. On a pump station, that is a pump running against a closed valve, or a reservoir filling when nobody asked for it. On a line, it is an unplanned stop, a call-out, and a shift spent establishing whether anything upstream moved.

Two things temper it. The attack needs someone to click, which the agency's scoring records as required user interaction, and the scores themselves land in the medium band rather than the top of it. No exploitation aimed at this defect has been reported to the agency.

What does not temper it is the timeline. A supported product gives you a fixed release to chase and a maintenance window to install it in. Here the only route off the defect is a migration to a different generation of the runtime, with logic to port, re-commissioning to schedule and downtime to negotiate with whoever owns production.

The questions this puts to the people who own the plant

The first question is not about the defect at all. It is whether this software is anywhere on site, and that is harder to answer than it sounds, because software that costs nothing arrives without a purchase order. The people to ask are the integrators, the contractors who did the last retrofit, and the engineer who built the rig that was never decommissioned.

Where it is found, the question worth putting to whoever holds the maintenance record is what the management interface is reachable from. A page opened from an engineering workstation on a separated network is a different exposure from one opened on a machine that also reads email, and the answer decides how much of this advisory lands.

For the supplier or integrator who installed it, the question is what their support now covers, given the line is retired. Whether the migration carries the existing control logic across, what re-commissioning it needs, and which budget line wears the cost, are all questions with answers, and they are answers worth holding before a budget cycle closes rather than after.

End-of-life is not an incident, which is why it rarely gets a meeting. This advisory turns a housekeeping item into one with a date attached: the defect is public, the remedy is a migration, and the only site that gets to choose when that migration happens is the one that knows where its copies are. Finding them is the work.

The technical record

The advisory is ICSA-26-265-09, released 22 September 2026, covering OpenPLC Runtime v3 from Autonomy Logic. The affected product version is listed as OpenPLC 3.

The defect is tracked as CVE-2026-88020 and classed as CWE-79, cross-site scripting. It arises where the web interface routes to a program using a query string parameter that is not encoded.

Scoring is CVSS v3.1 base 6.1, medium, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, and CVSS v4.0 base 5.3, medium, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N.

Remediation is a vendor fix by replacement, not by patch: Autonomy Logic recommends moving to OpenPLC v4, the earlier line being end-of-life with no further patches, bug fixes or security updates due.

Sectors listed are critical manufacturing, energy, transportation systems, and water and wastewater systems, with deployment worldwide and the company headquartered in the United States. The vulnerability was reported to the agency by researchers at Secnora. The advisory closes with the agency's standing guidance on network exposure and remote access.