CVSS 8.6: Authenticated attackers execute code on Advantech ADAM-3600 via long file paths

Remote authenticated attackers can execute arbitrary code on Advantech ADAM-3600 devices due to a stack-based buffer overflow vulnerability identified as CVE-2026-43856. The National Vulnerability Database rates this flaw with a CVSS score of 8.6, marking it as a high-severity issue. This vulnerability exists specifically within the FileProcess::CheckDir function, which fails to properly validate the length of input data provided by users who have already gained access to the system.

What environments are exposed to this risk?

The vulnerability affects all Advantech ADAM-3600 units that are running software versions prior to 2.8.5.0. Organizations that have not updated their hardware to this specific version or later remain potentially exposed. The National Vulnerability Database record explicitly lists versions before 2.8.5.0 as affected, meaning any deployment using older firmware is potentially vulnerable to exploitation if an attacker can achieve authentication.

How does the exploitation mechanism work?

An attacker must first obtain valid authentication credentials for the target ADAM-3600 device. Once authenticated, the adversary can trigger the stack-based buffer overflow by submitting a file path that exceeds 1024 bytes in length. The FileProcess::CheckDir function processes this oversized input without adequate boundary checks, allowing the attacker to overwrite memory and achieve arbitrary code execution on the compromised system.

What is the severity rating for this flaw?

The National Vulnerability Database assigns a CVSS score of 8.6 to CVE-2026-43856, which falls into the high severity category. This rating reflects the significant impact of remote code execution on the confidentiality, integrity, and availability of the affected system. The requirement for authentication limits the initial attack surface, but the high score indicates that successful exploitation grants the attacker substantial control over the device.

Is there a confirmed fix available?

The source material indicates that Advantech ADAM-3600 devices prior to version 2.8.5.0 are affected. The records do not explicitly confirm that a patch has been released or verified for all environments. Teams should verify their current software versions against the affected list and prepare to update to version 2.8.5.0 or later once the vendor confirms the fix resolves the buffer overflow issue.

Detection notes

Security operations teams should monitor for unusual process executions or memory allocation errors on systems, particularly following authentication events. Check whether system logs show repeated attempts to access files with abnormally long path strings, as this may indicate exploitation attempts. Look for unexpected network connections originating from the affected device, which could signal remote code execution. Implement strict input validation monitoring on critical functions and ensure that authentication logs are correlated with subsequent system actions to identify compromised accounts.

Background: Buffer overflow vulnerabilities

A buffer overflow vulnerability causes a crash or exploit when a program writes more data into a fixed-size memory buffer than it can hold. This overwrites adjacent memory, including return addresses. Attackers manipulate this overflow to inject malicious code or redirect execution. The root cause is missing bounds checking during data input or processing.

Read the full guide: What Causes a Buffer Overflow Vulnerability: The Memory Logic Breakdown

What to do and how to stay safe: Advantech

• Audit all Advantech ADAM-3600 devices to identify those running software versions prior to 2.8.5.0 and prioritize them for assessment.
• Restrict authentication credentials for systems to reduce the risk of unauthorized access required for exploitation.
• Monitor system logs for anomalies such as unusually long file path requests or unexpected process executions on affected devices.
• Prepare to update affected systems to version 2.8.5.0 or later once the vendor confirms the patch resolves the vulnerability.

Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-43856?

The National Vulnerability Database rates CVE-2026-43856 with a CVSS score of 8.6, which is classified as high severity.

Which Advantech ADAM-3600 versions are affected?

Advantech ADAM-3600 devices running software versions prior to 2.8.5.0 are affected by this stack-based buffer overflow vulnerability.

How can an attacker exploit this vulnerability?

A remote authenticated attacker can exploit this flaw by providing a file path longer than 1024 bytes to the FileProcess::CheckDir function.