CVE-2026-22904 is a stack-based buffer overflow vulnerability identified in the WAGO 0852-1322 industrial controller. The root cause is improper length validation when parsing multiple HTTP cookie fields, including the TRACKID cookie. An attacker can craft oversized cookie values and send them to the device's web interface without requiring authentication or user interaction. This triggers a stack buffer overflow, which can crash the device (denial-of-service) or potentially allow remote code execution, enabling full compromise of the device. The vulnerability is classified under CWE-121 (stack-based buffer overflow) and has a CVSS v3.1 score of 9.8, reflecting its critical impact and ease of exploitation over the network. The device is commonly used in industrial automation environments for controlling and monitoring processes. No patches or exploits are currently publicly available, but the vulnerability was reserved and published in early 2026. The lack of authentication requirement and the network attack vector make this vulnerability especially dangerous in operational technology (OT) environments where these controllers are deployed. Attackers exploiting this flaw could disrupt critical infrastructure or gain persistent control over industrial processes.

For European organizations, particularly those in manufacturing, energy, and critical infrastructure sectors relying on WAGO 0852-1322 controllers, this vulnerability poses a severe risk. Exploitation can lead to denial-of-service conditions, halting industrial operations and causing significant financial and safety impacts. More critically, remote code execution could allow attackers to manipulate industrial processes, potentially causing physical damage or safety hazards. The unauthenticated, network-based nature of the vulnerability increases the likelihood of exploitation, especially if devices are exposed to less secure networks or the internet. Disruption or compromise of these controllers could affect supply chains and critical services, amplifying the impact across multiple sectors. The absence of known exploits currently provides a window for proactive mitigation, but the critical severity demands urgent attention.

1. Immediately implement network segmentation to isolate WAGO 0852-1322 devices from general IT networks and restrict access to trusted management systems only. 2. Deploy firewall rules and intrusion prevention systems (IPS) to block or monitor suspicious HTTP requests containing oversized cookie headers targeting these devices. 3. Monitor network traffic for anomalous cookie field sizes or repeated malformed requests to detect potential exploitation attempts. 4. Engage with WAGO for official patches or firmware updates addressing CVE-2026-22904 and apply them promptly once available. 5. If patches are delayed, consider temporary mitigations such as disabling or restricting web interface access on the devices. 6. Conduct thorough asset inventories to identify all affected devices and ensure they are included in vulnerability management programs. 7. Train operational technology security teams on this vulnerability to enhance detection and response capabilities. 8. Implement strict access controls and multi-factor authentication on management interfaces to reduce exposure.