---
id: "CVE-2026-18768"
page: "https://infrastack.ai/live/CVE-2026-18768"
kind: "vulnerability"
aliases: ["CVE-2026-18768"]
title: "Beckhoff TwinCAT 3 TcRouter.sys driver lets local low-privilege users access arbitrary physical memory"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "TcRouter.sys", "fixed": ["3.1.0.2365"], "affected": "< 3.1.0.2365", "ecosystem": "vendor"}, {"name": "TwinCAT.XAR.Base", "fixed": ["3.18.1"], "affected": "< 3.18.1", "ecosystem": "vendor"}, {"name": "TwinCAT 3 Build 4024 (ADS, XAR, XAE)", "fixed": ["3.1.4024.79"], "affected": "< 3.1.4024.79", "ecosystem": "vendor"}]
ecosystems: []
tags: ["beckhoff", "ics", "infrastructure", "kernel-driver", "local-privilege", "twincat", "windows"]
not_affected_if: ["no-tcrouter-driver", "no-twincat-installed"]
published_at: "2026-11-11T09:17:15+00:00"
first_seen_at: "2026-11-11T09:26:49+00:00"
updated_at: "2026-11-11T09:30:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18768", "first_seen_at": "2026-11-11T09:26:49+00:00"}, {"source": "analyst", "url": "https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf", "first_seen_at": "2026-11-11T09:30:07+00:00", "cites": ["https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf", "https://github.com/magicsword-io/LOLDrivers/issues/296"]}]
exploit_sources: []
---

# Beckhoff TwinCAT 3 TcRouter.sys driver lets local low-privilege users access arbitrary physical memory

Link for people: https://infrastack.ai/live/CVE-2026-18768 (this .md is for agents)

Beckhoff's TcRouter.sys driver, installed by some TwinCAT 3 products for Windows, exposes IOCTL calls that let a local low-privileged user access arbitrary physical memory or define its mapping, leading to full compromise of the machine. Fixed in TcRouter.sys 3.1.0.2365. Sibling CVEs in the same advisory: CVE-2026-18767 (I/O ports), CVE-2026-18769 (moving physical memory).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:TcRouter.sys affected < 3.1.0.2365 fixed 3.1.0.2365
- vendor:TwinCAT.XAR.Base affected < 3.18.1 fixed 3.18.1
- vendor:TwinCAT 3 Build 4024 (ADS, XAR, XAE) affected < 3.1.4024.79 fixed 3.1.4024.79

## How to check

On Windows machines with TwinCAT 3 (ADS, XAR, XAE), check the file version of TcRouter.sys (usually under C:\Windows\System32\drivers; right-click > Properties > Details). Below 3.1.0.2365 is vulnerable. Also check the TcPkg package TwinCAT.XAR.Base (< 3.18.1) or TwinCAT 3 Build 4024 (< 3.1.4024.79). Also check if you run TwinCAT 3 Build 4026 workloads (Standard Runtime/Engineering < 4026.25.0).

## Fix

Update TwinCAT components: TcRouter.sys 3.1.0.2365 or later, TwinCAT.XAR.Base 3.18.1 or later, TwinCAT 3 Build 4024 3.1.4024.79 or later, TwinCAT Standard Runtime/Engineering 4026.25.0 or later. Beckhoff's text says only 'update to a recent version of the affected components'.

## Timeline

- 2026-11-11T09:26:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-18768
- 2026-11-11T09:30:07+00:00 analyst https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf — Beckhoff advisory 2026-001 / VDE-2026-087 read; vendor, versions, fix thresholds confirmed. No exploitation or PoC for this CVE seen; LOLDrivers issue covers the older driver family. Beckhoff's mitigation is to dedicate the PC and restrict access (workaround, not a fix). Not searched on X.

## Documents

- [advisory] Beckhoff Security Advisory 2026-001: Exposed IOCTLs in TcRouter.sys https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf
- [mentions] LOLDrivers: TcIo.sys + TcRouter.sys (Beckhoff TwinCAT 3) https://github.com/magicsword-io/LOLDrivers/issues/296

## From the sources

A local low privileged attacker can access arbitrary physical memory or define its mapping via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_