---
id: "CVE-2026-60036"
page: "https://infrastack.ai/live/CVE-2026-60036"
kind: "vulnerability"
aliases: ["CVE-2026-60036"]
title: "OS command injection in patch activate of mbCONNECT24, mymbCONNECT24 and myREX24V2 before 2.21.0"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "mbCONNECT24", "fixed": ["2.21.0"], "affected": ">= 2.0.0, < 2.21.0", "ecosystem": "vendor"}, {"name": "mymbCONNECT24", "fixed": ["2.21.0"], "affected": ">= 2.0.0, < 2.21.0", "ecosystem": "vendor"}, {"name": "myREX24V2", "fixed": ["2.21.0"], "affected": ">= 2.0.0, < 2.21.0", "ecosystem": "vendor"}, {"name": "myREX24V2.virtual", "fixed": ["2.21.0"], "affected": ">= 2.0.0, < 2.21.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["command-injection", "helmholz", "ics", "mb-connect-line", "mbconnect24", "mymbconnect24", "myrex24v2", "other", "self-hosted"]
not_affected_if: ["version-2.21.0-or-later"]
published_at: "2026-11-10T09:17:22+00:00"
first_seen_at: "2026-11-10T09:21:08+00:00"
updated_at: "2026-11-10T09:27:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60036", "first_seen_at": "2026-11-10T09:21:08+00:00"}, {"source": "analyst", "url": "https://www.certvde.com/en/advisories/VDE-2026-079/", "first_seen_at": "2026-11-10T09:27:17+00:00", "cites": ["https://www.certvde.com/en/advisories/VDE-2026-079/", "https://www.certvde.com/en/advisories/VDE-2026-141/"]}]
exploit_sources: []
---

# OS command injection in patch activate of mbCONNECT24, mymbCONNECT24 and myREX24V2 before 2.21.0

Link for people: https://infrastack.ai/live/CVE-2026-60036 (this .md is for agents)

An authenticated high-privileged remote user can inject OS commands through the backend patch activate function of MB connect line mbCONNECT24/mymbCONNECT24 and Helmholz myREX24V2/myREX24V2.virtual, leading to code execution. Fixed in 2.21.0. Found by SySS GmbH.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:mbCONNECT24 affected >= 2.0.0, < 2.21.0 fixed 2.21.0
- vendor:mymbCONNECT24 affected >= 2.0.0, < 2.21.0 fixed 2.21.0
- vendor:myREX24V2 affected >= 2.0.0, < 2.21.0 fixed 2.21.0
- vendor:myREX24V2.virtual affected >= 2.0.0, < 2.21.0 fixed 2.21.0

## How to check

Check the firmware/software version of your mbCONNECT24, mymbCONNECT24, myREX24V2 or myREX24V2.virtual instance in the admin interface; versions 2.0.0 up to but not including 2.21.0 are affected.

## Fix

Update the instance to version 2.21.0.

## Timeline

- 2026-11-10T09:21:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-60036
- 2026-11-10T09:27:17+00:00 analyst https://www.certvde.com/en/advisories/VDE-2026-079/ — Identified via CVE record (CERT@VDE) and advisories VDE-2026-079 and VDE-2026-141; CWE-78, fixed in 2.21.0. No exploitation or PoC found; no social search done (just published). Version-check location in UI is not stated by vendor.

## Documents

- [advisory] VDE-2026-079 MB connect line mbCONNECT24/mymbCONNECT24 https://www.certvde.com/en/advisories/VDE-2026-079/
- [advisory] VDE-2026-141 Helmholz myREX24V2/myREX24V2.virtual https://www.certvde.com/en/advisories/VDE-2026-141/

## From the sources

A high privileged remote attacker can perform a code injection in the backends patch activate function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_