Remote Code Execution Vulnerability in MQTT Broker by Vendor
CVE-2026-44091

8.8HIGH

Key Information:

Vendor: Phoenix Contact
Status: Charx Sec-3150; Charx Sec-3100; Charx Sec-3050; Charx Sec-3000
Vendor: CVE Published:; 30 July 2026

🔔 Create Phoenix Contact Vulnerability Alert

What is CVE-2026-44091?

An unauthenticated remote attacker can exploit a flaw in the MQTT Broker by posting a crafted malicious ID, which leads to the creation of unauthorized configuration entries. This vulnerability can compromise the integrity and availability of the system, potentially allowing attackers to manipulate configurations or disrupt service.

Affected Version(s)

CHARX SEC-3000 1.0.0 < 1.9.1

CHARX SEC-3050 1.0.0 < 1.9.1

CHARX SEC-3100 1.0.0 < 1.9.1

References

https://www.certvde.com/en/advisories/VDE-2026-008/

CVSS V4

Score:

8.8

Severity:

HIGH

Confidentiality:

None

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 30, 2026
Vulnerability Reserved
May 5, 2026

Credit

ZDI

CVE-2026-44091 Data

JSON