RT-Labs AB of Gothenburg, Sweden, has published cybersecurity advisory RRTL-260921-1 (dated 21 September 2026, revision 2) covering six vulnerabilities in SOEM (Simple Open EtherCAT Master). SOEM is open-source software that lets a PC or controller act as the master on an EtherCAT network. EtherCAT, short for Ethernet for Control Automation Technology, is a fast industrial Ethernet network used to talk to servo drives, input and output modules and other field devices in motion control, robotics, test rigs and PC-based industrial controllers. Every SOEM version before 2.0.1 is affected, and all six issues are fixed in SOEM 2.0.1, which was released on GitHub on 15 October 2026.
The six Common Vulnerabilities and Exposures (CVE) entries, with their scores under version 3.1 of the Common Vulnerability Scoring System (CVSS), are:
CVE-2026-82944, rated 8.8 (High): a buffer overflow in CANopen over EtherCAT (CoE) data uploads that arrive in several segments. A buffer overflow means the software writes more data than the memory set aside for it can hold, which can crash the program or let an attacker run their own code.
CVE-2026-70388, rated 8.3 (High): memory corruption caused by a math error when the master checks message lengths, which can lead to a crash or code execution on the master.
CVE-2026-82947, rated 7.1 (High): several out-of-bounds reads in frame processing. An out-of-bounds read means the software reads memory past the end of the area it was supposed to use, which can leak information or cause a crash.
CVE-2026-82943, rated 6.5: an out-of-bounds read caused by unchecked length values, which RT-Labs says could expose up to 64 kilobytes of the master's memory.
CVE-2026-82945, rated 6.5: memory corruption when the master builds its configuration table for a device, which can disrupt later operations. This one is reached automatically while the master scans the network, before the network reaches its normal operating state.
CVE-2026-82946, rated 6.5: a null pointer dereference in mailbox error handling (the mailbox is the channel the master uses to exchange messages with each device), which means the software tries to use a memory reference that has already been cleared and crashes. The result is a denial of service, because the master stops.
What these have in common: every one of them is triggered by a malicious or compromised device on the same EtherCAT network. The master trusts length and size values that the devices send back, and in these cases it did not check them carefully enough. The National Vulnerability Database (NVD) published CVE-2026-82944 on 26 October 2026 with the same 8.8 score and an adjacent network attack vector, which means the attacker has to be on the local network segment rather than coming in from the internet. None of the six are in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog, and no exploitation has been reported.
Where it shows up, plant floor to cloud: SOEM lives in the controller or industrial PC that runs the EtherCAT master, right next to the motion and machine control logic. On the plant floor, the drives, input and output modules and other EtherCAT devices are the side that could carry the attack, whether that is a tampered spare part, a counterfeit replacement or a device that has itself been compromised. Engineering laptops matter too, because they are often plugged straight into machine networks for commissioning and troubleshooting. Further up, the issue is a supply chain one. Because SOEM is open source, it is embedded in many products, and those products stay vulnerable until each vendor rebuilds its firmware or software on SOEM 2.0.1 and ships an update.
What the Red Tiger team recommends:
1. Find out which of your products embed SOEM. Ask your machine builders, integrators and controller vendors directly, and request updates built on SOEM 2.0.1 or later. If you build your own software on SOEM, upgrade and rebuild.
2. Keep EtherCAT segments physically and logically isolated from other networks, never connected to public networks, and control who can plug a device or laptop into them.
3. Check where replacement parts and spares come from. Buy from the original manufacturer or an authorized distributor, and inspect devices before they go onto a live machine network.
4. Monitor your machine networks for devices you do not expect, and apply vendor updates through change control once they are tested and available.
We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min
Sources: RT-Labs advisory RRTL-260921-1: https://rt-labs.com/wp-content/uploads/2026/10/RRTL-260921-01.pdf
NVD entry for CVE-2026-82944: https://nvd.nist.gov/vuln/detail/CVE-2026-82944
SOEM 2.0.1 release: https://github.com/OpenEtherCATsociety/SOEM/releases/tag/v2.0.1
Check out our resources and book a follow-up call with our team.
