CVE-2026-25086
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-25086 is a high-severity Multiple Binds to the Same Port (CWE-605) vulnerability in Automatedlogic (inferred from references). Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-25086 is a vulnerability in the WebCTRL software that, under certain conditions, allows an attacker to bind to the same port used by WebCTRL. This enables the attacker to craft and send malicious packets, impersonating the WebCTRL service without requiring code injection into the software itself. Published on 2026-03-21, the issue carries a CVSS v3.1 base score of 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and maps to CWE-605.
An attacker with local access can exploit this vulnerability with low complexity and no privileges or user interaction required. Exploitation allows high-impact compromise of confidentiality and integrity, such as intercepting or altering communications by impersonating the legitimate WebCTRL service, while availability remains unaffected due to the unchanged scope.
Advisories providing mitigation guidance include CISA ICSA-26-078-08 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08, Automated Logic's security commitment page at https://www.automatedlogic.com/en/company/security-commitment/, and the corresponding CSAF JSON file at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13844
Vulnerability Data
Under certain conditions, an attacker could bind to the same port used by WebCTRL. This could allow the attacker to craft and send malicious packets and impersonate the WebCTRL service without requiring code injection into the WebCTRL software.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Configuration settings can mandate exclusive-address-use options or firewall rules that disallow multiple binds to the same port.
Information flow enforcement can restrict which processes are authorized to bind to a given port, preventing port stealing.
Boundary protection at managed interfaces can enforce exclusive port binding and block unauthorized services from claiming the same port.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Protecting networks from unauthorized logical access directly prevents illicit port binding or service theft.
Documenting authorized flows helps identify expected port usage but does not prevent unauthorized binds.
Hardened configuration baselines can enforce exclusive port binding and disable reuse options.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Configuration management can enforce and audit port-binding settings across systems.
Network security controls can enforce exclusive port binding and service registration policies.
Security of network services includes configuration to prevent unauthorized services from binding to privileged ports.
Secure system architecture principles require unique service endpoints and prevent port collisions by design.
Secure coding practices can include checks to ensure sockets request exclusive port binding.