August 6, 2026
AutomationDirect Productivity Suite Has 6 Flaws
August 6, 2026
On July 16, 2026, CISA published advisory ICSA-26-197-04 covering six vulnerabilities in AutomationDirect Productivity Suite version 4.6.2.2. The affected CVEs are CVE-2026-60063, CVE-2026-61389, CVE-2026-60140, CVE-2026-57896, CVE-2026-60073, and CVE-2026-61378. Two of those carry a CVSS v3.1 score of 7.0, which puts them squarely in the HIGH severity band.
If your business runs any kind of light manufacturing, assembly, or process control and you use AutomationDirect PLCs programmed through Productivity Suite, this touches you directly. An attacker with local or physical access to the engineering workstation can trigger memory corruption, expose sensitive data, crash the application, or escalate their own privileges on the machine. That's not a theoretical lab scenario. That's a disgruntled employee, a contractor with a USB drive, or someone who walked past an unlocked workstation.
Most of the flaws are out-of-bounds read and write issues in the software's kernel driver. An attacker sends a crafted IOCTL request, the driver reads or writes memory outside its intended boundaries, and the kernel gets corrupted. For CVE-2026-60063 and CVE-2026-61389, that can mean privilege escalation, meaning a low-privilege user suddenly has full system access. For CVE-2026-60140, it can mean sensitive information leaking out of memory or the whole application going down.
There's also a divide-by-zero class in the mix. Those tend to cause crashes rather than code execution, but a crashed engineering workstation during a production run is still a real problem.
The good news is that all of these require local access. An attacker can't just fire these off from the internet. The bad news is that "local access" is a lot more common than people assume on a shop floor.
AutomationDirect has already released a patched version. Update Productivity Suite to v4.7.0.47 or above. Downloads are available directly from AutomationDirect's support page. If you can do this today, do it. There's no good reason to stay on v4.6.2.2.
If you're in a situation where updating right now would require a planned maintenance window or vendor coordination, CISA's compensating controls are reasonable in the interim:
I'd add one thing CISA doesn't spell out: if that engineering workstation is also being used for email, web browsing, or anything else, stop that. Dedicated control system machines should do one job. Every extra application is another attack surface.
ICS software has a long history of memory management problems because a lot of it was written before security was a design priority. Kernel-level drivers are hard to write safely, and they often don't get the same security review attention that, say, a web application would. We covered something similar when the XZ Utils flaw hit industrial automation gear, and the pattern is consistent: software that was built for reliability and performance, not adversarial conditions, ends up with flaws that are genuinely exploitable once someone is motivated to look.
Small manufacturers are not invisible to attackers. They're often easier targets than large enterprises because they don't have a security team watching the engineering floor. If you're running OT equipment connected to any part of your business network, you need to treat that connection as a risk, not a convenience.
Patch v4.6.2.2 now. If you're not sure what version you're running or whether your workstation is properly segmented from the rest of your network, that's worth finding out before something forces you to. Exine works with small and mid-size businesses in NJ and NYC on exactly this kind of problem. If you want someone to take a look, you can book an IT assessment and we'll tell you where you actually stand.
Probably not directly. This software is used to program AutomationDirect PLCs. If your business doesn't run industrial control equipment or automation hardware, you're not exposed. But if you have any shop floor or process control systems, check what software manages them.
Open the Productivity Suite application and look under Help or About. The version number will be displayed there. If it shows v4.6.2.2, you're running the affected release and should update to v4.7.0.47 or above as soon as possible.
No. All six CVEs require local or physical access to the engineering workstation. That limits the attack surface, but it doesn't eliminate risk. Insider threats, compromised contractor accounts, and unsecured physical access to control system machines are all realistic scenarios worth taking seriously.
IOCTL stands for input/output control. It's how software communicates with kernel-level drivers. The vulnerabilities in Productivity Suite let an attacker send a specially crafted IOCTL that tricks the driver into reading or writing outside safe memory boundaries, which can corrupt the kernel or expose data.
