Key points
- CVE-2026-43852 affects Advantech ADAM-3600 devices running firmware versions prior to 2.8.5.0.
- The flaw carries a CVSS score of 8.2, classified as high severity by the National Vulnerability Database.
- An attacker with valid authentication credentials can exploit this issue to write files to arbitrary locations.
Advantech ADAM-3600 industrial devices running firmware versions earlier than 2.8.5.0 contain a high-severity security flaw. The National Vulnerability Database lists this issue as CVE-2026-43852 with a CVSS score of 8.2. Users of these specific hardware modules must verify their current firmware version immediately. The vulnerability allows an attacker who has already authenticated to the system to write files to arbitrary locations on the device. This capability poses a significant risk to the integrity of industrial control environments.
In plain English
This security problem means that if someone has a valid login for an ADAM-3600 module, they can place new files anywhere on the system. The source material specifies that an authenticated attacker can write files to arbitrary locations. It does not specify the level of privilege required beyond authentication. This ability to write files to arbitrary locations is the core issue identified in the advisory. The flaw exists in versions prior to 2.8.5.0.
The background
The National Vulnerability Database records this specific weakness for Advantech hardware. The advisory identifies the affected product line as the ADAM-3600 series. The version threshold for this vulnerability is version 2.8.5.0. Any device running firmware before this specific release is considered vulnerable. The CVSS rating of 8.2 places this flaw in the high severity category. This rating reflects the potential impact of an attacker gaining the ability to manipulate system files through authenticated access.
What changes now
System administrators must identify all ADAM-3600 units currently in operation. They need to check the firmware version against the 2.8.5.0 threshold. Devices running older versions are exposed to this file-write vulnerability. Until a device is updated to version 2.8.5.0 or later, it remains susceptible to exploitation by authenticated users. Organizations should prioritize inventory checks to locate these specific modules within their industrial networks.
Who needs to act first
Teams usually update systems with the highest network exposure first. Check whether external or semi-trusted users have authentication access to these devices. Roll out fixes to a small test group to ensure industrial processes remain stable. Back up current configurations before applying any changes. Reduce exposure by restricting login credentials to essential personnel only. Monitor logs for unusual file creation activity while waiting for widespread updates. Verify that all legacy units are accounted for in the update schedule.
What to do and how to stay safe: Advantech
- Audit all Advantech ADAM-3600 devices to identify those running firmware versions prior to 2.8.5.0.
- Restrict authentication credentials to minimize the number of users who could exploit this flaw.
- Monitor system logs for unauthorized file creation or modification by authenticated accounts.
- Prepare to update firmware once the vendor confirms availability for your specific hardware revision.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this Advantech vulnerability?
The CVE ID is CVE-2026-43852.
How severe is this vulnerability?
It has a CVSS score of 8.2, which is rated as high severity.
Which Advantech products are affected?
Advantech ADAM-3600 devices running firmware versions prior to 2.8.5.0 are affected.
