Pilz released two coordinated CERT@VDE advisories on October 20, 2026 — VDE-2026-100 and VDE-2026-101 — disclosing six vulnerabilities in its IndustrialPI 4 industrial PC and calling for immediate patching of four affected Operating System images. The flaws, discovered by Nozomi Networks Labs and spanning kernel memory corruption, race conditions, path traversal, and CSRF, put the industrial edge controllers used in safety-relevant applications at risk of denial of service, credential exfiltration, and kernel memory corruption.
All four currently shipped IndustrialPI OS builds — 10.06.2025, 15.06.2026, 23.06.2025, and 25.12.2025, installed on the IndustrialPI 4 hardware — are affected by both advisories.
VDE-2026-100: Six CVE Scores and What They Mean
VDE-2026-100 targets the piControl kernel module (KUNBUS, version 2.6.2 prior to the fix in 2.8.0-1) that underpins the process-image management layer of the IndustrialPI. Exploitation requires local authenticated access with device-configuration privileges — a realistic threat model for operators, integrators, or compromised local accounts. Here is the full breakdown:
| CVE |
CVSS |
Type (CWE) |
Impact |
| CVE-2026-13196 |
7.8 (High) |
Out-of-bounds Write (CWE-787) |
Kernel memory corruption via crafted process-image configuration data → full code execution at kernel level or denial of service. |
| CVE-2026-13197 |
7.0 (High) |
Race Condition (CWE-362) |
Use-after-free and invalid pointer dereferences on kernel configuration objects triggered by concurrent requests → memory corruption and DoS. |
| CVE-2026-13198 |
6.5 (Medium) |
Race Condition (CWE-362) |
Kernel heap corruption and disclosure of a small amount of adjacent kernel memory via event-notification race conditions from concurrent threads. |
VDE-2026-101: PiCtory and RevPiPyLoad — Three More CVEs
Issued simultaneously on October 20, VDE-2026-101 covers the PiCtory web configuration tool (< 2.17.0) and RevPiPyLoad package (< 0.11.1), two user-space components shipped with every IndustrialPI OS image:
| CVE |
CVSS |
Type (CWE) |
Impact |
| CVE-2026-57472 |
7.1 (High) |
Path Traversal (CWE-22) |
Local unauthenticated attacker can delete arbitrary files with RevPiPyLoad daemon privileges — including configuration and credential material. |
| CVE-2026-57471 |
5.5 (Medium) |
Path Traversal (CWE-22) |
Local unauthenticated file read, including sensitive credentials and configuration data. |
| CVE-2026-57469 |
5.4 (Medium) |
CSRF (CWE-352) |
Remote unauthenticated attacker can induce authenticated operators to delete project/configuration files or reset the control runtime via the PiCtory web backend. |
Why Industrial Edge Controller Kernel Vulnerabilities Are a P0
The IndustrialPI 4 is not a conventional PLC — it is an industrial PC built on the KUNBUS Revolution Pi platform, running a custom Linux OS that hosts safety-relevant applications. That architectural choice is precisely why these CVEs matter more than a typical enterprise PC bug:
-
piControl is a kernel module, not a user library. The process-image buffer sits in kernel memory. An out-of-bounds write (CVE-2026-13196) corrupts adjacent kernel data structures — a single write misalignment can escalate to full kernel-level code execution. This is not a user-space RCE that can be sandboxed.
-
Race conditions in kernel config paths are a reliable primitive. CVE-2026-13197 and 13198 both rely on concurrent crafted requests. Race conditions in kernel code are notoriously exploitable once the timing is understood — and Nozomi Networks Labs has already demonstrated reliable exploitation paths for kernel use-after-free bugs.
-
Path traversal with daemon privileges means config and credential exfiltration. CVE-2026-57471 lets a local unauthenticated attacker read arbitrary files as the RevPiPyLoad daemon — which typically owns configuration files, TLS keys, and operator credentials. Combined with CVE-2026-57472 (delete), an attacker can silently extract then destroy evidence.
-
CSRF in the PiCtory backend means remote DoS via social engineering. An operator visiting a phishing page during normal admin activity could have their control runtime reset or project files deleted — no malware or local access needed.
Pilz in 2026: A Pattern of Serious Vulnerabilities
The October 20 advisories are not isolated — they are the latest in a 2026 pattern of serious disclosures affecting the IndustrialPI and related Pilz products. Earlier this year, CERT@VDE issued:
-
VDE-2026-072 (August 2026): Multiple Linux kernel vulnerabilities in the
linux-image-revpi-v8 package, including CVE-2026-43284, CVE-2026-46300, and CVE-2026-31431.
-
VDE-2026-045 (July 2025): Missing default authentication on Node-RED integration — unauthenticated remote access.
-
VDE-2026-039 (July 2025): Authentication bypass in the IndustrialPI webstatus application.
-
VDE-2026-006 (February 2026): Four vulnerabilities in PITmode authentication components (third-party package issues).
The breadth of this audit wave suggests Pilz is systematically reviewing dependencies and platform components — which is good news long term, but means operators need to treat the IndustrialPI as an actively maintained software platform rather than a "plug-and-forget" edge device.
What To Patch and Where to Find the Fixes
-
piControl kernel module: update
picontrol package to version 2.8.0-1 or higher. The affected versions on the four shipped OS images are below both 2.7.0-1 and 2.8.0-1.
-
PiCtory web config tool: update the
pictory package to version 2.17.0 or higher.
-
RevPiPyLoad package: update
revpipyload to version 0.11.1 or higher.
-
Zero-trust mitigations if patching is delayed: restrict local operator accounts from running untrusted code, disable or network-isolate the PiCtory web backend, and monitor access to the IndustrialPI 4's physical I/O connectors (CVE-2026-13196's exploitation path involves the piControl character device).
Security PLC and Edge-Controller Sourcing
An edge controller breach at a safety-relevant site usually means an operator has compromised or lost access to the device — and the backup controller must take over reliably. Pilz has long competed in the safety PLC market against Allen-Bradley's GuardLogix family. If you need spares or replacements for safety PLCs and safety I/O modules while patching IndustrialPI platforms, consider tested-surplus options without OEM lead times:
Looking for safety-rated PLC, I/O, or edge-controller replacements? Contact PLC Source PRO for current stock and lead times.
Key Takeaways
- Pilz CERT@VDE VDE-2026-100 and VDE-2026-101 (October 20, 2026) disclose six vulnerabilities in the IndustrialPI 4 platform — three in the piControl kernel module (CVSS 7.8/7.0/6.5) and three in user-space components PiCtory and RevPiPyLoad (CVSS 7.1/5.5/5.4).
- All four shipped IndustrialPI OS images (10.06.2025, 15.06.2026, 23.06.2025, 25.12.2025) on IndustrialPI 4 hardware are affected.
- Most critical: CVE-2026-13196 (out-of-bounds write in piControl kernel module, CVSS 7.8) — local authenticated access escalates to kernel memory corruption; CVE-2026-57471/57472 (path traversal) let local attackers read or delete arbitrary files including credentials.
- Fix versions: picontrol 2.8.0-1+, pictory 2.17.0+, revpipyload 0.11.1+.
- This is the fifth major Pilz vulnerability disclosure in 2026 — the pattern indicates an active dependency and platform audit that operators should track going forward.
Frequently Asked Questions
Which of the six CVEs is the most dangerous?
CVE-2026-13196 (CVSS 7.8, out-of-bounds write in piControl's process-image buffer) is the highest severity and the most difficult to detect — it operates at the kernel level and corrupts memory adjacent to the process-image buffer that safety-relevant I/O data passes through. Exploitation requires local authenticated access with device-configuration privileges, which makes the threat realistic for any industrial site with on-site integrators, contractors, or compromised operator accounts. CVE-2026-57471 and 57472 (CVSS 5.5/7.1, path traversal in RevPiPyLoad) are arguably the most damaging at deployment time — a local attacker can silently extract credentials before deleting configuration files.
Do I need to patch all three packages, or is one fix enough?
You must patch all three if your IndustrialPI runs on any of the four affected OS images. VDE-2026-100 and VDE-2026-101 cover different layers — piControl is a kernel module, PiCtory and RevPiPyLoad are user-space services that are always installed together. Even if you disable the PiCtory web backend, the RevPiPyLoad path traversal and the piControl kernel bugs remain exploitable. The safe minimum is picontrol ≥2.8.0-1, pictory ≥2.17.0, and revpipyload ≥0.11.1.
Is the IndustrialPI the same as a PLC like a Pilz PNOZ relay?
No. The Pilz PNOZ family are safety relays and compact safety PLCs that execute hardwired safety functions (e-stop, light curtains) with SIL 2-3 certification. The IndustrialPI 4 is a Linux-based industrial edge controller built on the KUNBUS Revolution Pi platform — it runs standard Linux userspace software (Python, Node-RED, Docker) in addition to safety-relevant logic. The two serve different layers of a safety architecture: PNOZ relays sit at the field layer (L1), while the IndustrialPI sits at the edge/driver layer (L2). The CVEs in VDE-2026-100/101 affect the IndustrialPI only and do not affect PNOZ relays.
Sources: CERT@VDE VDE-2026-100 · CERT@VDE VDE-2026-101 · NVD CVE-2026-13196 · CVE-2026-13197 · CVE-2026-57472 · CVE-2026-13198 · Pilz CSAF (PPSA-2026-004)