Remote Code Modification Vulnerability in Asset Administration Shell by Vendor
CVE-2026-94293

9.3CRITICAL

Key Information:

Vendor: Murrelektronik
Status: Software Aas Edge Client All Versions
Vendor: CVE Published:; 6 October 2026

🔔 Create Murrelektronik Vulnerability Alert

What is CVE-2026-94293?

A security flaw exists in the Asset Administration Shell that allows unauthenticated remote attackers to send PATCH requests, enabling them to modify submodel data. Additionally, attackers can exploit this vulnerability to access all data returned by the GET endpoints, posing a significant risk to data integrity and confidentiality.

Affected Version(s)

Software AAS Edge Client all 0.0.0

References

https://www.certvde.com/en/advisories/VDE-2026-108/

CVSS V4

Score:

9.3

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 6, 2026
Vulnerability Reserved
Sep 21, 2026

Credit

kta1kri

CVE-2026-94293 Data

JSON