Apache Software Foundation Apache PLC4X vulnerabilities

4 CVEs affecting Apache Software Foundation Apache PLC4X, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-102511, published 2026-09-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-102509, published 2026-09-30. High severity, CVSS 8.7. EPSS: 0.4% chance of exploitation in the next 30 days. Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation of Apache PLC4X (PLC4J) allow a malicious or impersonated…
CVE-2026-102510, published 2026-09-30. High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days. Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size Value in the Go implementation of Apache PLC4X (PLC4Go) allow a malicious…
CVE-2026-102511, published 2026-09-30. High severity, CVSS 8.5. EPSS: 0.2% chance of exploitation in the next 30 days. Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X (PLC4Go) allows an attacker able to send UDP datagrams to the discovering host…
CVE-2026-102508, published 2026-09-30. Critical severity, CVSS 9.2. EPSS: 0.1% chance of exploitation in the next 30 days. Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X (PLC4J) allows an attacker in a network position between client and server to…