TCROUTER.SYS · CVE-2026-18767 · Infrastructure
FIX → 3.1.0.2365 · 3.18.1 · 3.1.4024.79 ✓ verified
Beckhoff advisory 2026-001 (VDE-2026-087): affected TcRouter.sys versions expose IOCTLs that let a local low-privileged user or process access I/O ports, leading to full compromise of the device. Sibling CVE-2026-18768 (physical memory access) and CVE-2026-18769 (physical memory move) are in the same advisory. Affected: Windows PCs and industrial controllers running Beckhoff TwinCAT 3 (ADS, XAR, XAE) that install TcRouter.sys below 3.1.0.2365. An attacker needs a local foothold as a low-privileged user. Machines without TwinCAT can skip it.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only machines where the TcRouter.sys driver is installed are exposed, and the attacker must already be running code locally. The sources do not name the affected products or versions, so teams should first confirm whether the driver is present on their Windows systems.
Not affected if driver-not-installed, no-twincat, patched-driver
Who cares beckhoff, ics, kernel-driver, local, tcrouter-sys, twincat, windows
3.1.0.2365 are affected3.18.1) or TwinCAT 3 Build 4024 (< )A local low privileged attacker or process can access I/O ports via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
3.1.4024.79Upgrade to 3.1.0.2365 · 3.18.1 · 3.1.4024.79
3.1.0.2365 or later, via TwinCAT.XAR.Base 3.18.1 or later (Build 4026) or TwinCAT 3 Build 4024 version 3.1.4024.79 or later