CVE-2026-44092

CVE-2026-44092 is a critical (CVSS 9.1) vulnerability in a ModbusServer component that exposes an MQTT subscription endpoint allowing unauthenticated remote input injection. The EPSS score of 0.0038 is misleading—this is not a sign the vulnerability is low-risk. Rather, it reflects that ModbusServer-over-MQTT is niche infrastructure that automated scanners rarely probe. An EPSS prediction of low exploitation probability says more about the obscurity of the target than about its attractiveness to a determined adversary. Treat this as a high-severity finding regardless of statistical models. The critical question is whether this is a code defect or a deployment misconfiguration. If the ModbusServer exposes an unauthenticated MQTT endpoint on a reachable network interface, the vulnerability describes a deployment failure—specifically, an MQTT broker without TLS client certificates, ACL restrictions on publish access, or network segmentation isolating the OT boundary. A code patch would address input validation. But if no patch exists, your remediation path is architectural: harden the MQTT broker, restrict subscriber permissions to specific authenticated clients, and ensure the MQTT-to-Modbus bridge sits behind a firewall with strict ingress rules. The integrity-and-availability-only impact profile is notable. The absence of confidentiality impact does not indicate limited severity—it indicates the attacker's likely intent is process manipulation rather than data theft. An unauthenticated actor who can inject arbitrary input into a Modbus server can issue commands to PLCs, disrupt physical processes, or trigger conditions requiring manual shutdown. This is a safety-relevant vulnerability in an OT context. Prioritize: verify your MQTT broker configuration immediately. Check whether anonymous or unauthenticated publishing is permitted on the topic your ModbusServer subscribes to. If your deployment uses authentication and TLS on the MQTT channel, and the broker is segmented from untrusted networks, the practical exploitability drops significantly—but do not assume this without verifying the specific configuration. Without a confirmed vendor patch, treat broker hardening and network segmentation as your compensating controls.

Reviewed through automated stages and approved by a human before publication.