Description
Incomplete cleanup vulnerability in ABB My Control System.

This issue affects My Control System: 26.4 and 26.5.
Published: 2026-10-15
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Disk Space Exhaustion
Action: Patch Now
AI Analysis

Impact

An incomplete cleanup routine after XML conversion can leave temporary files on the system. This can progressively consume available disk space, ultimately leading to a denial of service if the control system runs out of storage. The weakness is a resource exhaustion flaw, classified as CWE-459.

Affected Systems

The affected product is ABB’s My Control System software, specifically versions 26.4 and 26.5.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity, yet the EPSS score of less than 1% points to a low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. While the description does not detail precise prerequisites, it can be inferred that an attacker could trigger the issue by submitting XML data that induces conversion, either over a network channel or via a local interface that processes XML.

Generated by OpenCVE AI on October 16, 2026 at 21:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest software update released by ABB for My Control System.
  • Provision sufficient disk capacity and monitor usage to mitigate the risk while a patch is applied.
  • If the XML conversion feature is not required for your deployment, disable or restrict it to reduce exposure.

Generated by OpenCVE AI on October 16, 2026 at 21:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Abb
Abb my Control System
Vendors & Products Abb
Abb my Control System

Thu, 15 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Description Incomplete cleanup vulnerability in ABB My Control System. This issue affects My Control System: 26.4 and 26.5.
Title My Control System 26.5 – Disk space exhaustion due to incorrect temporary file cleanup after XML conversion
Weaknesses CWE-459
References
Metrics cvssV3_1

{'score': 5.2, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Abb My Control System
cve-icon MITRE

Status: PUBLISHED

Assigner: ABB

Published:

Updated: 2026-10-15T13:14:31.439Z

Reserved: 2026-07-27T08:36:08.049Z

Link: CVE-2026-17525

cve-icon Vulnrichment

Updated: 2026-10-15T13:14:27.793Z

cve-icon NVD

Status : Deferred

Published: 2026-10-15T11:17:28.300

Modified: 2026-10-16T15:36:06.590

Link: CVE-2026-17525

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T12:30:11Z

Weaknesses