---
id: "CVE-2026-18767"
page: "https://infrastack.ai/live/CVE-2026-18767"
kind: "vulnerability"
aliases: ["CVE-2026-18767"]
title: "Beckhoff TwinCAT TcRouter.sys driver lets local low-privileged users access I/O ports"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "TcRouter.sys", "fixed": ["3.1.0.2365"], "affected": "< 3.1.0.2365", "ecosystem": "vendor"}, {"name": "TwinCAT.XAR.Base", "fixed": ["3.18.1"], "affected": "< 3.18.1", "ecosystem": "vendor"}, {"name": "TwinCAT 3 Build 4024", "fixed": ["3.1.4024.79"], "affected": "< 3.1.4024.79", "ecosystem": "vendor"}]
ecosystems: []
tags: ["beckhoff", "ics", "infrastructure", "kernel-driver", "local", "tcrouter-sys", "twincat", "windows"]
not_affected_if: ["driver-not-installed", "no-twincat", "patched-driver"]
published_at: "2026-11-11T09:17:15+00:00"
first_seen_at: "2026-11-11T09:26:49+00:00"
updated_at: "2026-11-11T09:30:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18767", "first_seen_at": "2026-11-11T09:26:49+00:00"}, {"source": "analyst", "url": "https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf", "first_seen_at": "2026-11-11T09:30:02+00:00", "cites": ["https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf", "https://www.loldrivers.io/drivers/12998ebb-8c74-4e44-89a2-2a71c0f6e92b/"]}]
exploit_sources: []
---

# Beckhoff TwinCAT TcRouter.sys driver lets local low-privileged users access I/O ports

Link for people: https://infrastack.ai/live/CVE-2026-18767 (this .md is for agents)

Beckhoff advisory 2026-001 (VDE-2026-087): affected TcRouter.sys versions expose IOCTLs that let a local low-privileged user or process access I/O ports, leading to full compromise of the device. Sibling CVE-2026-18768 (physical memory access) and CVE-2026-18769 (physical memory move) are in the same advisory. Affected: Windows PCs and industrial controllers running Beckhoff TwinCAT 3 (ADS, XAR, XAE) that install TcRouter.sys below 3.1.0.2365. An attacker needs a local foothold as a low-privileged user. Machines without TwinCAT can skip it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:TcRouter.sys affected < 3.1.0.2365 fixed 3.1.0.2365
- vendor:TwinCAT.XAR.Base affected < 3.18.1 fixed 3.18.1
- vendor:TwinCAT 3 Build 4024 affected < 3.1.4024.79 fixed 3.1.4024.79

## How to check

On Windows machines with TwinCAT installed, check the file version of TcRouter.sys: versions below 3.1.0.2365 are affected. Also check the TcPkg package TwinCAT.XAR.Base (< 3.18.1) or TwinCAT 3 Build 4024 (< 3.1.4024.79).

## Fix

Update to TcRouter.sys 3.1.0.2365 or later, via TwinCAT.XAR.Base 3.18.1 or later (Build 4026) or TwinCAT 3 Build 4024 version 3.1.4024.79 or later. Beckhoff's text says only: update to a recent version of the affected components.

## Timeline

- 2026-11-11T09:26:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-18767
- 2026-11-11T09:30:02+00:00 analyst https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf — Beckhoff advisory 2026-001 read; vendor, versions and fix confirmed. No exploitation or PoC for these CVEs seen (LOLDrivers entry describes the driver generally). No social search done; no repo-readable check written (file version on host).

## Documents

- [advisory] Beckhoff Security Advisory 2026-001: Exposed IOCTLs in TcRouter.sys https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf
- [mentions] LOLDrivers: TcIo.sys and TcRouter.sys https://www.loldrivers.io/drivers/12998ebb-8c74-4e44-89a2-2a71c0f6e92b/

## From the sources

A local low privileged attacker or process can access I/O ports via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_