Home / Items
Vendor advisorySeverity 7.5 high
AC500 V3 - Invalid type usage in visualization
3ADR011565 · ABB · September 28, 2026
Summary
An update is available that resolves publicly reported vulnerability in the products versions listed as affected in the advisory.
An attacker who successfully exploited these vulnerabilities could cause a denial-of-service (DoS).
From ABB (vendor's own words, quoted), quoted as published. Check the source before acting.
What to do
The problem is corrected in the following product version:
- AC500 V3 firmware version 3.9.1
ABB recommends that customers apply the update at earliest convenience. This firmware version is released for all AC500 V3 PLC types and integrated into Automation Builder 2.9.1. Automation Builder 2.9.1 is available for download from the related download site.
https://www.abb.com/global/en/areas/motion/digital-tools/automation-builder/software-download
Refer to section “General security recommendations” for further advise on how to keep your system secure.
Disable the web server, if it is enabled, but not required for the PLC operation.
Vendor fix or mitigation, quoted from the advisory.
Each CVE in this advisory
| CVE | Severity | Known exploited | Exploit likelihood |
|---|---|---|---|
| CVE-2025-41738 | 7.5 high | No | 0.4% |
Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).
Affected products
Why it's on these mode pages
- Pipeline: Vendor table: ABB (matched by rule)
Change history
- September 28, 2026: Initial version.
- November 9, 2026: First collected by Watch
Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com