CISA 2026-07-23

MZ Automation lib60870

CVE-2026-16002

Machine-generated analysis · WAYSCloud LLM

Versions of MZ Automation lib60870 up to 2.4.0 are vulnerable to an out-of-bounds read that can cause a denial-of-service. The vendor recommends updating to 2.4.1 or later.

Context

The advisory concerns the MZ Automation lib60870 library. Versions 2.4.0 and earlier contain an out-of-bounds read that may crash the parsing process, resulting in denial of service. The library is deployed worldwide in chemical, energy, water and wastewater sectors.

Operator considerations

Check: Verify installed lib60870 versions and identify any that are 2.4.0 or earlier.
Isolate: Restrict network access to systems using the library, placing them behind firewalls.
Patch: Update lib60870 to version 2.4.1 or later as recommended by the vendor.
Log: Monitor for parsing process crashes or unexpected termination events.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability could cause the parsing process to crash, which will cause a denial of service.

The following versions of MZ Automation lib60870 are affected:

lib60870

Read the full advisory on CISA →