CVE-2026-8024: iba AG ibaPDA and ibaDatCoordinator: Critical Unauthenticated Deserialization Flaw

Overview

CVE-2026-8024 is a deserialization of untrusted data weakness (CWE-502) in two iba products: ibaPDA and ibaDatCoordinator. According to the description supplied by CERT@VDE, which is the CNA, a remote attacker who needs no credentials may exploit the flaw to gain full access to affected systems. The CVE was published on 2026-06-18, and the NVD status is currently "Deferred".

Impact

The CNA scores the issue at 9.8 (Critical) under CVSS 3.1, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It also provides a CVSS 4.0 score of 9.3. The vector indicates the following:

the flaw is reachable over the network;
attack complexity is low;
no privileges or user interaction are required;
the impact on confidentiality, integrity and availability is high.

ibaPDA and ibaDatCoordinator are typically used for process data acquisition and data management in industrial environments. A full compromise could therefore expose process data, allow that data to be manipulated, and give an attacker a foothold inside operational technology (OT) networks. This last point is an inference based on how these products are normally deployed.

Affected products and versions

The record names ibaPDA and ibaDatCoordinator but contains no structured list of affected or fixed versions. Use the CERT@VDE advisory VDE-2026-051 and its CSAF document to determine which releases are affected.

Exploitation status

The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog. No confirmed exploitation appears in the sources consulted, and no EPSS score is available. Even so, the flaw is unauthenticated, reachable over the network and low in complexity, which makes it an attractive target. It should be prioritized accordingly.

Remediation and mitigation

Review VDE-2026-051 and apply the updates or mitigations iba AG recommends there. The fact that this record lists no fix does not mean that no fix exists.
Make sure ibaPDA and ibaDatCoordinator services are not reachable from the internet or from untrusted networks.
Segment OT networks and allow access to these services only from required engineering or management hosts, using firewalls or allow-lists.
Where remote access is needed, require VPN or jump-host access with strong authentication.
Restrict the operating-system privileges of the service accounts that run these products.

Detection guidance

Inventory all ibaPDA and ibaDatCoordinator installations and compare their versions with the advisory.
Monitor network traffic to these services for connections from unexpected sources.
On hosts running these products, watch for anomalous processes being started, new accounts being created, or unexpected outbound connections.
Forward host and network logs to a SIEM and alert on deviations from the normal behavior of OT systems.

Limitations of the available information

The record contains no affected or fixed version data and no EPSS or SSVC information. It also gives no technical detail about the vulnerable interface or protocol. The NVD has not completed its own analysis because the entry is marked "Deferred". The CERT@VDE advisory remains the authoritative source for scope and remediation.

Frequently asked questions

What is CVE-2026-8024?

It is a deserialization of untrusted data vulnerability (CWE-502) in ibaPDA and ibaDatCoordinator. A remote, unauthenticated attacker may exploit it to gain full access to affected systems.

How severe is it?

The CNA rates it critical. The CVSS 3.1 score is 9.8 and the CVSS 4.0 score is 9.3.

Is it being exploited?

It is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

The record does not list affected versions. Check CERT@VDE advisory VDE-2026-051 for the affected releases.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.