TCROUTER.SYS · CVE-2026-18769 · Infrastructure
FIX → 3.1.0.2365 · 3.18.1 · 3.1.4024.79 · 4026.25.0 ✓ verified
Beckhoff's TcRouter.sys driver, installed by some TwinCAT products for Windows, exposes IOCTLs that let a local low-privileged user move arbitrary physical memory content, which Beckhoff says results in full compromise of the device. Part of Beckhoff advisory 2026-001 (VDE-2026-087) with CVE-2026-18767 and CVE-2026-18768.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Windows PCs, engineering workstations and industrial PCs with TwinCAT 3 (ADS, XAR, XAE) installed, since these install TcRouter.sys. An attacker needs a local low-privileged account or process on the machine. Machines without TwinCAT, or where only trusted people have access, can skip it or are at lower risk.
Not affected if no-tcrouter-driver, no-twincat, no-untrusted-local-users, tcrouter-3.1.0.2365-or-later
Who cares beckhoff, ics, kernel-driver, local-privilege-escalation, twincat, windows
A local low privileged attacker can move arbitrary physical memory content via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
3.1.0.2365 is affected3.18.1), TwinCAT 3 Build 4024 (< 3.1.4024.79), or the Build 4026 Standard Runtime/Engineering workloads (< 4026.25.0)Upgrade to 3.1.0.2365 · 3.18.1 · 3.1.4024.79 · 4026.25.0
Update the affected TwinCAT components so TcRouter.sys is 3.1.0.2365 or later: TwinCAT.XAR.Base 3.18.1, Build 4024 3.1.4024.79, Build 4026 workloads 4026.25.0 (fixed bounds from the Beckhoff advisorys affected-version table; its Solution text says only update to a recent version').