---
id: "CVE-2026-110022"
kind: "vulnerability"
aliases: ["CVE-2026-110022"]
title: "PLCnext Engineer before 2026.6: unsigned plugin archive entries overwrite signed assemblies and run code"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "PLCnext Engineer", "fixed": ["2026.6"], "affected": "< 2026.6", "ecosystem": "vendor"}]
ecosystems: []
tags: ["dotnet", "ics", "other", "pfi", "phoenix-contact", "plcnext-engineer", "plugin-framework", "windows"]
not_affected_if: ["pfi-not-installed", "plcnext-engineer-2026.6-or-later"]
published_at: "2026-11-04T10:17:24+00:00"
first_seen_at: "2026-11-04T10:26:34+00:00"
updated_at: "2026-11-04T10:30:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110022", "first_seen_at": "2026-11-04T10:26:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T10:30:46+00:00"}]
---

# PLCnext Engineer before 2026.6: unsigned plugin archive entries overwrite signed assemblies and run code

The PFI plugin framework extracts DLL files from a signed plugin package but skips signature checks on some archive entries. A local attacker can overwrite a legitimate signed assembly with malicious code that the plugin loader then runs.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:PLCnext Engineer affected < 2026.6 fixed 2026.6

## How to check

Check the installed PLCnext Engineer version; any version below 2026.6 is affected. Also check where plugin packages come from: the vendor advises installing plugins only from trusted sources and verified engineering libraries.

## Fix

Upgrade PLCnext Engineer to 2026.6 (Phoenix Contact)

## Timeline

- 2026-11-04T10:26:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110022
- 2026-11-04T10:30:46+00:00 analyst — Phoenix Contact PLCnext Engineer < 2026.6, fixed in 2026.6, per CERT@VDE VDE-2026-121 (sibling CVEs 110935, 110021 same advisory). No exploitation or PoC found; no social search done (B tier).

## Documents

- [advisory] VDE-2026-121 Phoenix Contact PLCnext Engineer https://certvde.com/en/advisories/VDE-2026-121/

## From the sources

The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the signature verification. An unauthenticated local attacker can replace an unsigned DLL outside the signed prefix in the archive passes verification and overwrites the legitimate signed assembly at the same destination path. The plugin loader then instantiates the attacker-supplied code without any additional integrity check resulting in a full compromise of the affected systems.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_