Beckhoff TwinCAT: Driver Flaws Let a Local User Take Over Controller and Engineering PCs

Beckhoff Automation and CERT@VDE, the German coordination center for industrial security advisories, published Beckhoff Security Advisory 2026-001 (VDE-2026-087) on 11 November 2026. It covers three flaws in TcRouter.sys, a Windows driver that TwinCAT installs on the industrial PCs and engineering laptops that program and run Beckhoff automation. TwinCAT is common in machine building, packaging, material handling and process skids, so many plants run it without thinking of it as "Beckhoff software." Beckhoff has released fixed versions. The flaws are not known to be exploited, and they cannot be reached directly over the network.

What the flaws are

A driver is a piece of software that runs inside the core of Windows with full control of the machine. TcRouter.sys exposes control functions (called IOCTLs, short for input and output control requests) that ordinary programs can call. According to Beckhoff, these functions do not properly check who is calling them. The three flaws, CVE-2026-18767, CVE-2026-18768 and CVE-2026-18769, let a local user or program with ordinary (low) privileges reach hardware input and output ports, read or remap physical memory, or move memory contents around. Beckhoff says each one can lead to a full compromise of the affected device. Each is rated 7.8 (high) on version 3.1 of the Common Vulnerability Scoring System (CVSS) and 8.5 on version 4.0. Note that the first edition of Beckhoff's PDF lists two of the identifiers with a 2025 year; CERT@VDE lists all three as 2026 identifiers.

Which versions are affected

The affected products are TwinCAT 3 ADS (TC1000), TwinCAT 3 extended Automation Runtime (XAR) and TwinCAT 3 eXtended Automation Engineering (XAE) in Build 4024 before version 3.1.4024.79, and, for Build 4026, the TwinCAT.XAR.Base package before 3.18.1 (TwinCAT Standard Runtime and Standard Engineering workloads before 4026.25.0). The driver file itself is affected before version 3.1.0.2365.

Where this shows up, plant floor to cloud

On the plant floor, TwinCAT runs as the controller on Beckhoff industrial PCs and embedded PCs that drive machines and process skids. In the control room and the engineering office, TwinCAT XAE runs on the laptops and workstations that engineers and integrators use to build and download programs. Because the flaws need local access, the real risk is a chain: an attacker or a piece of malware that already has a foothold through a phishing email, a shared remote access account, an infected USB drive or a vendor laptop can use the driver to take full control of the PC that runs or programs the machine. A local flaw on a machine controller deserves more attention than the same flaw on an office PC.

What to do now

1. Find every Windows PC with TwinCAT installed, including machine controllers that came inside skids or equipment packages from an original equipment manufacturer (OEM) and engineering laptops that belong to integrators. Record the TwinCAT build and the TcRouter.sys version on each.
2. Plan updates to TwinCAT 3.1.4024.79 or later for Build 4024, and to TwinCAT.XAR.Base 3.18.1 or later (workloads 4026.25.0 or later) for Build 4026, during a planned outage and after testing on a spare or offline system. Ask OEMs whether their machine packages are covered under support.
3. Until the update is in place, follow Beckhoff's own mitigation: dedicate TwinCAT PCs to TwinCAT engineering or control only, limit local logins to trusted people, remove extra software, and install only software from trusted sources.
4. Tighten how people and vendors reach these PCs: no shared local accounts, no email or web browsing on controller PCs, controlled USB use, and remote access only through a monitored, multi-factor gateway.

Red Tiger does more than identify and harden weaknesses like this one. Our team can also install a firewall and sensor at the site, connect it to the Red Tiger 24x7 Security Operations Center (SOC), and monitor the plant for ongoing detection and response, with metrics and reports, so a foothold on an engineering PC is spotted before it reaches the machines.

We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min

Sources: Beckhoff Security Advisory 2026-001, 11 November 2026 https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2026-001.pdf ; CERT@VDE VDE-2026-087 https://certvde.com/en/advisories/VDE-2026-087