advantech has 65 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 42 in the last 90 days against 5 in the 90 before. The busiest recent month was October 2026 with 25. The median CVSS is 8.6 (high), with 10 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-89 (8) and CWE-78 (7). Most affected products: ADAM-3600 (30), EKI-1242IEIMS (15), webaccess/vpn (12).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.6
- Publish → KEV
- —
- Last 90 days
- 42 prev 5
Products
- ADAM-3600 30
- EKI-1242IEIMS 15
- webaccess/vpn 12
- deviceon/iedge 3
- WISE-6610-NB 2
- wise-deviceon_server 2
Worst active — by depth score
CVE-2026-79698Critical· 9.9A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WIS…67CVE-2026-79697Critical· 9.9A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WIS…67CVE-2026-73172Critical· 9.3Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the edgserver management service of Advantech EKI-1242EIMS in firmware version V1.06.01…52CVE-2026-43845Critical· 9.2A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.51CVE-2026-43844Critical· 9.3A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.51
advantech vulnerabilities
CVEs affecting advantech, newest first. Open any entry for full detail, references, and exploit status.
65 CVEsRSS
CVE-2025-34240Medium· 6.5Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, …
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, …
CVE-2025-34239High· 7.2Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated system administrator to execute arbitrary commands as the web server use…
Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated system administrator to execute arbitrary commands as the web server use…
CVE-2025-34238Medium· 6.5Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction() that allows an authenticated network administrator to cause the applicati…
Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction() that allows an authenticated network administrator to cause the applicati…
CVE-2025-34237Medium· 5.4Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via StandaloneVpnClientsController.addStandaloneVpnClientAction()
Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via StandaloneVpnClientsController.addStandaloneVpnClientAction(). Insufficient validation or escaping of user-supplied input may a…
CVE-2025-34236Medium· 5.4Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via NetworksController.addNetworkAction()
Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via NetworksController.addNetworkAction(). Insufficient validation or escaping of user-supplied input may allow an attacker to inje…