---
id: "CVE-2026-18769"
page: "https://infrastack.ai/live/CVE-2026-18769"
kind: "vulnerability"
aliases: ["CVE-2026-18769"]
title: "Beckhoff TwinCAT's TcRouter.sys driver lets low-privileged local users move physical memory"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "TcRouter.sys", "fixed": ["3.1.0.2365"], "affected": "< 3.1.0.2365", "ecosystem": "vendor"}, {"name": "TwinCAT.XAR.Base", "fixed": ["3.18.1"], "affected": "< 3.18.1", "ecosystem": "vendor"}, {"name": "TwinCAT 3 Build 4024", "fixed": ["3.1.4024.79"], "affected": "< 3.1.4024.79", "ecosystem": "vendor"}, {"name": "TwinCAT 3 Build 4026 workloads", "fixed": ["4026.25.0"], "affected": "< 4026.25.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["beckhoff", "ics", "infrastructure", "kernel-driver", "local-privilege-escalation", "twincat", "windows"]
not_affected_if: ["no-tcrouter-driver", "no-twincat", "no-untrusted-local-users", "tcrouter-3.1.0.2365-or-later"]
published_at: "2026-11-11T09:17:15+00:00"
first_seen_at: "2026-11-11T09:26:49+00:00"
updated_at: "2026-11-11T09:30:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18769", "first_seen_at": "2026-11-11T09:26:49+00:00"}, {"source": "analyst", "url": "https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf", "first_seen_at": "2026-11-11T09:30:05+00:00", "cites": ["https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf", "https://www.certvde.com/en/advisories/VDE-2026-087/"]}]
exploit_sources: []
---

# Beckhoff TwinCAT's TcRouter.sys driver lets low-privileged local users move physical memory

Link for people: https://infrastack.ai/live/CVE-2026-18769 (this .md is for agents)

Beckhoff's TcRouter.sys driver, installed by some TwinCAT products for Windows, exposes IOCTLs that let a local low-privileged user move arbitrary physical memory content, which Beckhoff says results in full compromise of the device. Part of Beckhoff advisory 2026-001 (VDE-2026-087) with CVE-2026-18767 and CVE-2026-18768.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:TcRouter.sys affected < 3.1.0.2365 fixed 3.1.0.2365
- vendor:TwinCAT.XAR.Base affected < 3.18.1 fixed 3.18.1
- vendor:TwinCAT 3 Build 4024 affected < 3.1.4024.79 fixed 3.1.4024.79
- vendor:TwinCAT 3 Build 4026 workloads affected < 4026.25.0 fixed 4026.25.0

## How to check

On Windows machines with TwinCAT, check the file version of TcRouter.sys (Properties > Details, or (Get-Item <path>\TcRouter.sys).VersionInfo in PowerShell): below 3.1.0.2365 is affected. Also check the installed TcPkg package TwinCAT.XAR.Base (< 3.18.1), TwinCAT 3 Build 4024 (< 3.1.4024.79), or the Build 4026 Standard Runtime/Engineering workloads (< 4026.25.0).

## Fix

Update the affected TwinCAT components so TcRouter.sys is 3.1.0.2365 or later: TwinCAT.XAR.Base 3.18.1, Build 4024 3.1.4024.79, Build 4026 workloads 4026.25.0 (fixed bounds from the Beckhoff advisory's affected-version table; its Solution text says only 'update to a recent version').

## Timeline

- 2026-11-11T09:26:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-18769
- 2026-11-11T09:30:05+00:00 analyst https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf — Read Beckhoff advisory 2026-001 / VDE-2026-087: vendor is Beckhoff TwinCAT; no exploitation mentioned. Advisory PDF has CVE-year typos (2025-). Workaround: dedicate the TwinCAT PC to trusted users. Check-script not written (needs file version of a binary).

## Documents

- [advisory] Beckhoff Security Advisory 2026-001: Exposed IOCTLs in TcRouter.sys https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf
- [advisory] CERT@VDE VDE-2026-087: Beckhoff TcRouter.sys https://www.certvde.com/en/advisories/VDE-2026-087/

## From the sources

A local low privileged attacker can move arbitrary physical memory content via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_