CVE-2026-35063

CVE-2026-35063 is an authentication bypass vulnerability in OpenPLC_V3 that affects the REST API endpoint responsible for user management. The vulnerability stems from insufficient authorization checks: while the API verifies JWT token presence, it fails to validate the authenticated user's role before allowing critical operations. This allows any standard user to delete administrator accounts or create new administrative accounts, resulting in complete privilege escalation and system compromise. The vulnerability carries a CVSS score of 8.8 (HIGH) with a network-based attack vector requiring low complexity and only low-level user privileges. The attack requires no user interaction and can result in high-impact consequences across confidentiality, integrity, and availability. With a FAUCET Risk Score of 51.0 out of 100, this represents a moderately serious threat requiring prompt attention. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and remains on an inactive hot list. The extremely low EPSS score of 0.00039 indicates minimal real-world exploitation probability to date. However, the straightforward nature of the privilege escalation means exploit code could be readily developed, making timely patching essential before the vulnerability gains wider attention.