MBCONNECT24 · CVE-2026-60036 · Other
FIX → 2.21.0 ✓ verified
An authenticated high-privileged remote user can inject OS commands through the backend patch activate function of MB connect line mbCONNECT24/mymbCONNECT24 and Helmholz myREX24V2/myREX24V2.virtual, leading to code execution. Fixed in 2.21.0. Found by SySS GmbH.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running a self-hosted mbCONNECT24/mymbCONNECT24 (MB connect line) or myREX24V2/myREX24V2.virtual (Helmholz) remote-access/IIoT gateway portal on version 2.x below 2.21.0. Exploitation needs a high-privileged (admin) account, so exposure is greatest where the backend is internet reachable or admin credentials are weak or shared; the advisory lists other bugs (XSS, CSRF, password reset) that may help reach admin. Instances already on 2.21.0 can skip it.
Not affected if version-2.21.0-or-later
Who cares command-injection, helmholz, ics, mb-connect-line, mbconnect24, mymbconnect24, myrex24v2, self-hosted
A high privileged remote attacker can perform a code injection in the backends patch activate function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Check the firmware/software version of your mbCONNECT24, mymbCONNECT24, myREX24V2 or myREX24V2.virtual instance in the admin interface; versions 2.0.0 up to but not including 2.21.0 are affected.
Upgrade to 2.21.0
Update the instance to version 2.21.0.