CVE-2026-35556

OpenPLC_V3 is affected by a plaintext password storage vulnerability (CVE-2026-35556) that enables attackers to retrieve stored credentials and access sensitive system information. The vulnerability has a CVSS score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction, indicating significant risk potential. The exploit is network-accessible, straightforward to execute, and impacts confidentiality severely, though integrity and availability are not affected. Currently, this vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and shows minimal exploitation activity, with an EPSS score of 0.00037 indicating low real-world exploitation likelihood at this time. Organizations running OpenPLC_V3 should prioritize patching efforts given the high severity rating and direct path to credential compromise, though immediate exploitation risk appears limited based on available threat intelligence.