CVE-2026-4769 - Exploits & Severity

Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This functionality is not formally documented and becomes accessible without authentication for a brief period in the early boot phase.

An unauthenticated remote attacker during the device boot window can access internal system processes and achieve full system compromise, including executing arbitrary commands and modifying system configurations.

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

No patch information available

Monitor and restrict network access to WAGO System I/O Field devices during startup periods. Implement network segmentation to limit exposure of these devices to untrusted networks. Consider disabling or securing the diagnostic capability if configuration options are available. Ensure devices are deployed in secure network environments with access controls. WAGO for guidance on permanent remediation options.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD published the first details for CVE-2026-4769

A CVSS base score of 9.8 has been assigned.

Feedly found the first article mentioning CVE-2026-4769 . See article

GitHub Advisories released a security advisory .

[GHSA-2r6r-vgg5-p59v] Certain devices in the WAGO System I/O Field series activate an internal diagnos

Critical CVE-2026-4769 Vulnerability in WAGO Devices Exposes Systems to Remote Attacks

CTI Daily Brief · 2026-07-13

WAGO patches a hidden early-boot diagnostic interface in I/O System Field couplers that lets an unauthenticated remote attacker take full control

Collect, analyze, and vulnerability reports faster using AI