MBCONNECT24 · CVE-2026-60043 · Other
FIX → 2.21.0 ✓ verified
Cross-site scripting in the backend of MB connect line mbCONNECT24/mymbCONNECT24 and Helmholz myREX24V2/myREX24V2.virtual (remote-maintenance portals). An unauthenticated attacker can run script in a logged-in backend user's browser, which can trigger server shutdown or restore of an uploaded backup. Vendor advisories rate it 9.3 and list firmware before 2.21.0 as affected; no exploitation or PoC is reported in the advisories.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run their own mbCONNECT24/mymbCONNECT24 (MB connect line) or myREX24V2/myREX24V2.virtual (Helmholz) remote-maintenance portal on firmware below 2.21.0. The attack needs a logged-in backend user to be lured into viewing attacker content. Others can skip it.
Who cares industrial, mbconnect24, mymbconnect24, myrex24v2, remote-access, self-hosted, web-admin-panel, xss
2.21.0 on mbCONNECT24, mymbCONNECT24, myREX24V2 or myREX24V2.virtual is affectedAn unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 2.21.0
2.21.0 (mbCONNECT24/mymbCONNECT24 per VDE-2026-079; myREX24V2/myREX24V2.virtual per VDE-2026-141)