CVE-2026-0936
Medium
Description
An Insertion of Sensitive Information into Log File vulnerability in B&R PVI client versions prior to 6.5 may be abused by an authenticated local attacker to gather credential information which is processed by the PVI client application. The logging function of the PVI client application is disabled by default and must be explicitly enabled by the user.
SeverityMedium
CVSS5.0
Exploit probability—
ProductProcess Visualization Interface (PVI)
PublishedJan 29, 2026
First seenJan 29, 2026
Weakness typeCWE-532CWE-532
How to fix
Update
- B&R Industrial Automation GmbH Process Visualization Interface (PVI)6.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| B&R Industrial Automation GmbH Process Visualization Interface (PVI) | 4, 6 ≤ v < 6.5 | 6.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.