How do I check whether I am affected by CVE-2026-43836?

Check the EdgeLink firmware version on each ADAM-3600 in its web UI or Advantech's device tooling. Anything below 2.8.5.0 is affected. Also check whether the device's proprietary-protocol and web ports are reachable from untrusted networks or the internet.

What is the fix for CVE-2026-43836?

Update ADAM-3600 EdgeLink to 2.8.5.0 or later (the vendor says to do this as soon as possible). Until then, keep the device off the internet, put it behind a firewall, and limit access to the proprietary protocol and web interface to trusted hosts. Confirm the exact fixed build on Advantech's firmware page.

Who is not affected by CVE-2026-43836?

Not affected if: firmware-2.8.5.0-or-later, not-internet-exposed.

Live › vulnerability › CVE-2026-43836

Go to dashboard

critical9.3Other

Forged network packet can run arbitrary commands with maximum privileges

Advantech ADAM-3600 EdgeLink (industrial remote terminal unit) has an unauthenticated network flaw. A forged packet makes the device run arbitrary commands with maximum privileges (CVSS 4.0 9.3). It is one of 30 flaws (CVE-2026-43829 to 43858) fixed in EdgeLink 2.8.5.0. The vendor's fix adds content-length and IP-address format validation and replaces the system() call with fork plus execv, which points to command injection. No exploitation reported.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

9.3

critical

scored by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker runs arbitrary commands as the highest privilege on the device.
CVSS said: 9.3. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-43836

Go to dashboard

critical9.3Other

Forged network packet can run arbitrary commands with maximum privileges

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

9.3

critical

scored by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker runs arbitrary commands as the highest privilege on the device.
CVSS said: 9.3. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Forged network packet can run arbitrary commands with maximum privileges

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

Forged network packet can run arbitrary commands with maximum privileges

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources