TCROUTER.SYS · CVE-2026-18768 · Infrastructure
FIX → 3.1.0.2365 · 3.18.1 · 3.1.4024.79 ✓ verified
Beckhoff's TcRouter.sys driver, installed by some TwinCAT 3 products for Windows, exposes IOCTL calls that let a local low-privileged user access arbitrary physical memory or define its mapping, leading to full compromise of the machine. Fixed in TcRouter.sys 3.1.0.2365. Sibling CVEs in the same advisory: CVE-2026-18767 (I/O ports), CVE-2026-18769 (moving physical memory).
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Windows machines with Beckhoff TwinCAT 3 (ADS, XAR, XAE Build 4024; Build 4026 via TwinCAT.XAR.Base) that install TcRouter.sys older than 3.1.0.2365. Any local low-privileged account can reach the driver's IOCTLs. Systems without TwinCAT, or already updated, can skip it. Beckhoff advises dedicating the PC to TwinCAT use and limiting access to trusted people.
Not affected if no-tcrouter-driver, no-twincat-installed
Who cares beckhoff, ics, kernel-driver, local-privilege, twincat, windows
A local low privileged attacker can access arbitrary physical memory or define its mapping via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
3.1.0.2365 is vulnerable3.18.1) or TwinCAT 3 Build 4024 (< 3.1.4024.79)4026.25.0)Upgrade to 3.1.0.2365 · 3.18.1 · 3.1.4024.79
3.1.0.2365 or later, TwinCAT.XAR.Base 3.18.1 or later, TwinCAT 3 Build 4024 3.1.4024.79 or later, TwinCAT Standard Runtime/Engineering 4026.25.0 or laters text says only update to a recent version of the affected components'