CVE-2026-44092: Phoenix Contact Charx Sec-3000

Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days.

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.

Affected products

• Phoenix Contact Charx Sec-3000: from 1.0.0, before 1.9.1 (fixed in 1.9.1)
• Phoenix Contact Charx Sec-3050: from 1.0.0, before 1.9.1 (fixed in 1.9.1)
• Phoenix Contact Charx Sec-3100: from 1.0.0, before 1.9.1 (fixed in 1.9.1)
• Phoenix Contact Charx Sec-3150: from 1.0.0, before 1.9.1 (fixed in 1.9.1)

Published 2026-07-30. Last modified 2026-07-30.