CVE-2026-17525 PUBLISHED

My Control System 26.5 – Disk space exhaustion due to incorrect temporary file cleanup after XML conversion

Assigner: ABB
Reserved: 27.07.2026 Published: 15.10.2026 Updated: 15.10.2026

Incomplete cleanup vulnerability in ABB My Control System.

This issue affects My Control System: 26.4 and 26.5.

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
CVSS Score: 5.2

CVSS 3.1

CVSS Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score: 5.1

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Adjacent	Confidentiality	None	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	None	Availability	High	Availability	None
Privileges Required	Low
User Interaction	Active

CVSS 4.0

Vendor	ABB
Product	My Control System
Versions	Default: unaffected Version 26.4 is affected Version 26.5 is affected