Is CVE-2026-32666 actively exploited?

No active exploitation of CVE-2026-32666 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-32666 be exploited remotely?

Yes. CVE-2026-32666 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-32666?

CVE-2026-32666 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-32666

HIGH

CVE-2026-32666

CWE-290Published: March 21, 2026· Updated: Mar 23, 2026

7.5

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:13.0th

Official Description

WebCTRL systems that communicate over BACnet inherit the protocol's lack

of network layer authentication. WebCTRL does not implement additional

validation of BACnet traffic so an attacker with network access could

spoof BACnet packets directed at either the WebCTRL server or associated

AutomatedLogic controllers. Spoofed packets may be processed as

legitimate.

NVD Source

Technical Analysis

CVE-2026-32666 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 7.5.