A cross-site scripting bug in OpenPLC Runtime v3 lets attackers hijack operator sessions and issue commands to the physical processes those controllers run.
CISA published an advisory (ICSA-26-265-09) for CVE-2026-88020, a cross-site scripting flaw in OpenPLC Runtime v3, made by Autonomy Logic. The web interface routes pages using a query string parameter that isn't encoded, so a crafted link can run script in a logged-in operator's browser. From there, an attacker can hijack session cookies and send state-changing requests as that operator, effectively taking control of the PLC. CISA rates it 6.1 on CVSS 3.1, medium severity, and it requires the operator to click a malicious link first.
OpenPLC is open-source controller software deployed worldwide across critical manufacturing, energy, transportation, and water and wastewater systems. Because v3 is end-of-life, Autonomy Logic isn't patching it - the fix is upgrading to v4, something industrial operators are historically slow to do. That leaves a session-hijacking flaw sitting in live controllers with no vendor fix coming, only CISA's standard advice to isolate control networks and avoid exposing them to the internet.
It's a reminder that in ICS land, end of life rarely means end of deployment.