Claroty researchers identified two vulnerabilities in EnOcean SmartServer, a multi-protocol gateway and edge controller for building automation. The first vulnerability (CVE-2026-22885) is a security bypass flaw, and the second (CVE-2026-20761) allows remote code execution. Exploitation involves improper validation of packet input, enabling attackers to manipulate system call arguments, bypass memory protections, leak memory, and execute arbitrary commands with root privileges on the Linux-based device. This could lead to full compromise of building management systems connected to the internet. EnOcean has issued a patch in SmartServer version 4.6 update 2 (4.60.023) to remediate these vulnerabilities. Legacy i.LON devices are also affected.

Successful exploitation can result in complete takeover of EnOcean SmartServer devices, granting attackers root-level access and arbitrary code execution capabilities. This compromises the integrity and availability of building management and automation systems, potentially affecting smart buildings, factories, and data centers relying on these devices. The vulnerabilities enable remote attackers to bypass security protections and execute malicious commands remotely. No active exploitation in the wild has been reported at the time of disclosure.

EnOcean has released an official patch in SmartServer version 4.6 update 2 (4.60.023) that addresses these vulnerabilities. Users should apply this update promptly to mitigate the risk. The vendor advisory confirms the availability of this fix. No additional mitigation steps are specified beyond applying the official update. Legacy i.LON device users should verify patch availability or vendor guidance for those products.