CVE-2026-16002

criticalCVSS 8.2covered by 2 sourcesfirst seen 2026-07-23

View CSAF Summary Successful exploitation of this vulnerability could cause the parsing process to crash, which will cause a denial of service. The following versions of MZ Automation lib60870 are affected: lib60870 <=2.4.0 CVSS Vendor Equipment Vulnerabilities v3 8.2 MZ Automation MZ Automation lib60870 Out-of-bounds Read Background Critical Infrastructure Sectors: Chemical, Energy, Water and Wastewater Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2026-16002 The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash the parsing process and cause a denial of service. View CVE Details Affected Products MZ Automation lib60870 Vendor: MZ Automation Product Version: MZ Automation lib60870: <=2.4.0 Product Status: known_affected Remediations Vendor fix MZ automation recommends users update to version 2.4.1 or later. Documentation can be found at https://github.com/mz-automation/lib60870/security/advisories/GHSA-f5xp-w6f3-vvrv. https://github.com/mz-automation/lib60870/security/advisories/GHSA-f5xp-w6f3-vvrv Relevant CWE: CWE-125 Out-of-bounds Read Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.2 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H 4.0 8.8 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N Acknowledgments Lars Tray reported this vulnerability to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this (these) vulnerability(ies). Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote acces

CSIRTS triage

What: An out-of-bounds read vulnerability could cause the parsing process to crash.
Who is affected: Users of lib60870 version 2.4.0 and earlier.
Urgency: Remediation is critical to prevent denial of service.
Action: Update to a version greater than 2.4.0.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-16002

Get an email if CVE-2026-16002 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all EPSS-scored CVEs.

Advisory coverage (2)

highCVE-2026-16002: The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to cr…nvd · 2026-07-23
criticalMZ Automation lib60870cisa · 2026-07-23

External references

NVD record for CVE-2026-16002

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-16002 status](https://www.csirts.com/badge/CVE-2026-16002)](https://www.csirts.com/cve/CVE-2026-16002)