My Control System 26.5 – Disk space exhaustion due to incorrect temporary file cleanup after XML conversion
MonitorCVSS 5.27paa025438Oct 15, 2026
ABB
Attack path
Attack VectorAdjacent
Auth RequiredLow
ComplexityLow
User InteractionRequired
Summary
My Control System versions 26.4 and 26.5 contain a vulnerability in temporary file cleanup after XML conversion operations. Temporary files are not properly deleted and can accumulate over time, eventually filling the disk and causing the system to stop responding or become inaccessible. The vulnerability requires local access and a low-privilege user account to exploit, and an attacker could trigger XML conversions to accelerate disk exhaustion.
What this means
What could happen
An attacker with local access and low privileges could fill the system's temporary storage with XML conversion files, causing the system to stop responding or become unavailable. This could interrupt control operations and require manual intervention to restore service.
Who's at risk
Organizations running ABB My Control System 26.4 or 26.5 (on Windows or Edgenius/Kubernetes deployments) should assess this issue. This affects control system operators and IT teams managing these instances, particularly those performing frequent XML conversions or processing user-submitted XML files.
How it could be exploited
An attacker with local access to the My Control System host and low-privilege user credentials could repeatedly trigger XML conversion operations or submit malformed XML that causes temporary files to accumulate without proper cleanup. Over time, the temporary directory fills the disk, causing the system to stop responding or crash.
Prerequisites
- Local access to the My Control System host
- Low-privilege user account on the affected system
- Ability to trigger or submit XML conversion operations
Local access requiredLow complexity exploitationLow privilege account neededAvailability impact (system stop/crash)
Exploitability
Unlikely to be exploited — EPSS score 0.1%
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
My Control System 26.426.4Fix available
My Control System 26.526.5Fix available
Remediation & Mitigation
0/3
Do now
0/2WORKAROUNDFor Windows environments, manually delete contents of C:\Users\<system service account>\AppData\Local\Temp to clear accumulated temporary files
WORKAROUNDFor Edgenius environments, run 'kubectl delete pod -l app.kubernetes.io/component=mcs-masterkpi -n my-control-system' to restart the container and clear temporary files (perform only when no analysis is in progress)
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
My Control System 26.4
HOTFIXUpdate My Control System 26.4 and 26.5 to version 26.6 or later
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/ff3ce89b-c898-4e9a-b558-a4ff4d8a74f0Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.