Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2020-27265: KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All ver

63
This week
CRITICAL 9.8REMOTEDOWNGRADEDOWNGRADEMITIGATE

CVE-2020-27265 is a critical-severity flaw (CVSS 9.8) affecting industrial gateway server, kepware kepserverex, opc-aggregator. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server: v7.68.804 and v7.66, Software Toolbox TOP Server: All 6.x versions are vulnerable to a stack-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and remotely exec

Why this priority

  • Critical severity
  • EPSS top 4%: very likely to be exploited
  • Remotely exploitable, no login, no user action

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score9.8 (Critical)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance12.5% (top 4%)
CISA exploited listNo
WeaknessCWE-121, CWE-787
Published2021-01-14
Last modified2026-06-17
Publisher (CNA): ICS-CERT · Vendor: ge · ptc · rockwellautomation

Share: LinkedIn · X · Reddit

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

ge industrial gateway server DOWNGRADE
Affected: 7.66 · 7.68.804
Fixed in: no fixed release known
Safe to downgrade to: a release before 7.66
1. Check installed version
apt-cache policy industrial-gateway-server || rpm -q industrial-gateway-server || industrial-gateway-server --version
2. No fixed release: DOWNGRADE to a release before 7.66 (Debian / Ubuntu)
apt-cache madison industrial-gateway-server sudo apt install industrial-gateway-server=<VERSION_BEFORE_7.66> sudo apt-mark hold industrial-gateway-server
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list industrial-gateway-server sudo dnf downgrade industrial-gateway-server-<VERSION_BEFORE_7.66> sudo dnf versionlock add industrial-gateway-server
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
ptc kepware kepserverex DOWNGRADE
Affected: 6.0 · 6.9
Fixed in: no fixed release known
Safe to downgrade to: a release before 6.0
1. Check installed version
apt-cache policy kepware-kepserverex || rpm -q kepware-kepserverex || kepware-kepserverex --version
2. No fixed release: DOWNGRADE to a release before 6.0 (Debian / Ubuntu)
apt-cache madison kepware-kepserverex sudo apt install kepware-kepserverex=<VERSION_BEFORE_6.0> sudo apt-mark hold kepware-kepserverex
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list kepware-kepserverex sudo dnf downgrade kepware-kepserverex-<VERSION_BEFORE_6.0> sudo dnf versionlock add kepware-kepserverex
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
ptc opc-aggregator MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy opc-aggregator || rpm -q opc-aggregator || opc-aggregator --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
ptc thingworx industrial connectivity MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy thingworx-industrial-connectivity || rpm -q thingworx-industrial-connectivity || thingworx-industrial-connectivity --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
ptc thingworx kepware server DOWNGRADE
Affected: 6.8 · 6.9
Fixed in: no fixed release known
Safe to downgrade to: a release before 6.8
1. Check installed version
apt-cache policy thingworx-kepware-server || rpm -q thingworx-kepware-server || thingworx-kepware-server --version
2. No fixed release: DOWNGRADE to a release before 6.8 (Debian / Ubuntu)
apt-cache madison thingworx-kepware-server sudo apt install thingworx-kepware-server=<VERSION_BEFORE_6.8> sudo apt-mark hold thingworx-kepware-server
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list thingworx-kepware-server sudo dnf downgrade thingworx-kepware-server-<VERSION_BEFORE_6.8> sudo dnf versionlock add thingworx-kepware-server
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
rockwellautomation kepserver enterprise DOWNGRADE
Affected: 6.6.504.0 · 6.9.572.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 6.6.504.0
1. Check installed version
apt-cache policy kepserver-enterprise || rpm -q kepserver-enterprise || kepserver-enterprise --version
2. No fixed release: DOWNGRADE to a release before 6.6.504.0 (Debian / Ubuntu)
apt-cache madison kepserver-enterprise sudo apt install kepserver-enterprise=<VERSION_BEFORE_6.6.504.0> sudo apt-mark hold kepserver-enterprise
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list kepserver-enterprise sudo dnf downgrade kepserver-enterprise-<VERSION_BEFORE_6.6.504.0> sudo dnf versionlock add kepserver-enterprise
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2020-27265?

industrial gateway server: downgrade or apply the listed mitigation; kepware kepserverex: downgrade or apply the listed mitigation; opc-aggregator: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2020-27265 being exploited?

CVE-2020-27265 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2020-27265 affect?

CVE-2020-27265 affects industrial gateway server, kepware kepserverex, opc-aggregator. Severity is critical (CVSS 9.8). KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server: v7.68.804 and

How urgent is CVE-2020-27265?

Priority 63/100. Critical severity; EPSS top 4%: very likely to be exploited; Remotely exploitable, no login, no user action

Software pages

Rockwell Automation vulnerabilities

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.