ABB Ability Edgenius
Act NowCVSS 7.8ICS-CERT ICSA-26-260-06Jun 25, 2026
ABB
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
CVE-2026-31431 is a Linux kernel privilege escalation vulnerability in ABB Ability Edgenius Gateway and Server products versions 3.2.0.0 through 3.2.4.0. A locally authenticated user or compromised container workload can exploit this flaw to gain root privileges and achieve complete system control. The vulnerability is actively being exploited in the wild and poses an immediate risk to edge automation infrastructure.
What this means
What could happen
An attacker with local access to an Edgenius Gateway or Server could gain root-level control of the entire device, allowing them to modify process setpoints, halt operations, or alter safety configurations. This affects all automation logic and data flowing through the compromised edge device.
Who's at risk
Water utilities, electric distribution operators, and manufacturing facilities running ABB Edgenius edge gateways (bE100, E3100C) or virtual servers (vE1000) for industrial automation, SCADA integration, or IoT data collection. Any site using Edgenius versions 3.2.0.0 through 3.2.4.0 is at risk.
How it could be exploited
An attacker with local shell access (via SSH, Cockpit, or compromised container) exploits a Linux kernel privilege escalation flaw to obtain root privileges. From root, they can modify system files, interrupt services, or inject malicious commands into industrial automation workflows.
Prerequisites
- Local shell access to the device (via SSH, Cockpit, or container access)
- Valid credentials for a local user account on Edgenius
- Ability to execute commands on the affected system
actively exploited (KEV)extremely high exploit probability (99.9% EPSS)gains root/full system controllow complexity privilege escalationno authentication required once local access obtainedaffects critical edge computing in industrial networks
Exploitability
Actively exploited — confirmed by CISA KEV
Metasploit module available — weaponized exploitView module ↗
Public Proof-of-Concept (PoC) on GitHub (10 repositories)
Affected products (3)
3 with fix
ProductAffected VersionsFix Status
Ability Edgenius Gateway - bE100≥ 3.2.0.0|<3.2.4.13.2.4.1
Ability Edgenius Gateway - E3100C≥ 3.2.0.0|<3.2.4.13.2.4.1
Ability Edgenius Server - vE1000≥ 3.2.0.0|<3.2.4.13.2.4.1
Remediation & Mitigation
0/6
Do now
0/5HOTFIXUpdate Ability Edgenius Gateway bE100 to version 3.2.4.1 or later
HOTFIXUpdate Ability Edgenius Gateway E3100C to version 3.2.4.1 or later
HOTFIXUpdate Ability Edgenius Server vE1000 to version 3.2.4.1 or later
WORKAROUNDRestrict SSH and Cockpit access to authorized engineering workstations and administrative networks only
HARDENINGDisable Cockpit management interface if not actively used for remote administration
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HARDENINGReview and remove any lower-privilege user accounts that are not required for normal operations
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/67c6a693-5507-4de3-a4f3-1635a34c1a4dGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.