MBCONNECT24 · CVE-2026-60039 · Other
FIX → 2.21.0 ✓ verified
A high-privileged remote user of the mbCONNECT24/mymbCONNECT24 (MB connect line) or myREX24V2/myREX24V2.virtual (Helmholz) backend can inject OS commands through the backup restore function, leading to code execution (CWE-78). Vendor CVSS 3.1 is 7.2; fixed in 2.21.0.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone running a self-managed mbCONNECT24, mymbCONNECT24, myREX24V2 or myREX24V2.virtual instance older than 2.21.0 (industrial remote-maintenance portals). Exploitation needs a high-privileged (admin) backend account; the same advisories list a CSRF (CVE-2026-60041) and XSS (CVE-2026-60043) that can make a logged-in backend user restore an uploaded backup. Users of a hosted portal that the vendor updates centrally need to confirm with their provider.
Not affected if managed-hosting, version-2.21.0-or-later
Who cares backup-restore, command-injection, industrial, mbconnect24, mymbconnect24, myrex24v2, ot, self-hosted
A high privileged remote attacker can perform a code injection in the backends backup restore function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
2.21.0 is affected per the vendor advisoriesUpgrade to 2.21.0
Update the instance to version 2.21.0 (per VDE-2026-079 and VDE-2026-141).