CVE-2026-60140

MEDIUM 6.1

AutomationDirect Productivity Suite Out-of-bounds Read

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This can lead to exposing sensitive information or causing the affected product to become unstable or unavailable.

CWE	CWE-125
Vendor	automationdirect
Product	productivity suite
Published	Jul 16, 2026

Stay Ahead of the Next One

Get instant alerts for automationdirect productivity suite

Be the first to know when new medium vulnerabilities affecting automationdirect productivity suite are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Affected Versions

AutomationDirect / Productivity Suite

0 ≤ v4.6.2.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

automationdirect.com: https://www.automationdirect.com/support/software-downloads cisa.gov: https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-04 github.com: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-197-04.json

Credits

Luca Borzacchiello of Nozomi Networks reported this vulnerability to CISA.