CVE-2026-35225 affects CODESYS EtherNetIP version 1.0.0.0 and involves an improper check for unusual or exceptional conditions (CWE-754) in the TCP connection handling of the EtherNet/IP adapter stack. An unauthenticated remote attacker can exploit this flaw to exhaust all available TCP connections, resulting in a denial-of-service that blocks legitimate clients from connecting. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity, with network attack vector, no required privileges or user interaction, and high impact on availability. No patch or remediation level has been published by the vendor as of the data provided.

The vulnerability allows unauthenticated remote attackers to cause a denial-of-service by exhausting all TCP connections in the affected EtherNet/IP adapter stack, preventing legitimate clients from establishing new connections. This impacts availability of the service but does not indicate direct compromise of confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor vendor communications for updates. In the meantime, consider network-level protections such as limiting exposure of the EtherNet/IP service to untrusted networks and applying rate limiting or connection throttling if possible.