Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
n/a n/a — EIPStackGroup OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in Connection Manager handling of ForwardOpen requests when p…
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U H N H 9.1 .0048 39.5 —
AFFECTED
Product Versions Fixed
n/a n/a – —
TIMELINE
Jun 8 Reserved by mitre
Jul 13 EXPLOIT PUBLISHED — CVE-2026-51537. Public exploit reference added.
Jul 13 Published (CNA: mitre)
Description
EIPStackGroup OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in Connection Manager handling of ForwardOpen requests when processing short malformed packets. An attacker can send a valid ENIP outer frame carrying a malformed CIP ForwardOpen/LargeForwardOpen request, causing the parser to continue reading fields even when request data is insufficient. This issue is remotely triggerable via network traffic and does not require authentication.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| June 8, 2026 | Reserved | Reserved by mitre |
| July 13, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-51537. Public exploit reference added. |
| July 13, 2026 | Published | Published (CNA: mitre) |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| n/a | n/a | — | n/a | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-51537 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.