CVE-2026-18769
A NVD · · CVE-2026-18769
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key metrics
- CVSS
- 7.8
- EPSS
- 0%
Key insight
Beyond the mere patch information, the advisory makes clear that an improperly secured IOCTL in the TwinCAT router driver allows full takeover of the automation controller once low-privilege local access already exists.
Description
CVE-2026-18769 affects the Windows driver TcRouter.sys, whose exposed IOCTL calls allow arbitrary physical memory contents to be moved. A locally authenticated attacker with low privileges can abuse this interface to manipulate memory and gain full control of the affected device. Exploitation requires that local access to the system already exists, so the flaw is primarily suited for privilege escalation after an initial foothold. At the time of publication by the NVD there are no indications of active exploitation, inclusion in the CISA KEV list, or a public proof of concept. Affected are systems with the driver installed, as typically found in automation and control environments.
Risk score
- cvss base
- 78.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 78.00
- industry weight
- 1.21
- freshness factor
- 1.00
- exploitability factor
- 0.75
- days old
- 0.00
- vendor mismatch penalty
- 0.00
Path: operational