CVE-2026-6284

CVE-2026-6284 affects programmable logic controllers (PLCs) and involves weak password security mechanisms that enable attackers to conduct brute force attacks against protected systems and services. The vulnerability stems from insufficient password complexity requirements and the absence of login attempt rate limiting controls. The vulnerability presents a critical severity risk with a CVSS score of 9.1, requiring only network access and no authentication or user interaction for exploitation. The attack successfully compromises confidentiality and integrity of affected systems, though availability is not directly impacted. There is currently no evidence of active exploitation in the wild, and the vulnerability does not appear on the CISA Known Exploited Vulnerabilities catalog. Community attention remains minimal based on available threat intelligence, with EPSS metrics indicating lower probability of exploitation compared to broader CVE populations. However, the absence of exploitation activity should not diminish concern given the critical severity rating and the straightforward nature of brute force attacks.