Advantech fixes 30 flaws in ADAM-3600 controllers, some rated 9.3

Advantech fixes 30 flaws in ADAM-3600 controllers, some rated 9.3

15 October 2026: Advantech has fixed 30 vulnerabilities, CVE-2026-43829 to CVE-2026-43858, in its ADAM-3600 industrial edge controller, with scores of up to 9.3, and says users should update to EdgeLink v2.8.5.0 "as soon as possible". Every version before 2.8.5.0 is affected; Advantech reports no exploitation.

Not yet independently verified. Advantech's advisory gives scores and the fixed version but no exploitation status; which of the 30 flaws need no login is read from the advisory's table and should be checked against the PDF before relying on it. We will update this when it can be confirmed, and remove this note.

How severe the flaws are

The scores on Advantech's advisory page break down as follows:

Score	CVEs
9.3	CVE-2026-43836, CVE-2026-43844
9.2	CVE-2026-43829, 43831, 43832, 43838, 43845
8.7	CVE-2026-43839
8.2 to 8.6	11 further CVEs
7.5	CVE-2026-43833, 43834, 43837, 43855
6.3 to 6.9	7 further CVEs

The advisory describes stack buffer overflows that can lead to code execution, at least one of them reachable without authentication through a logging function, and an overflow in cookie parsing that is exposed when the "SafeEnhancement" feature is turned on. Others allow command injection through a tampered firmware upgrade file and the upload of forged firmware, which Advantech warns could compromise a device "possibly permanently". The lower-rated issues are null pointer dereferences that crash the log and licence manager services.

Why it matters on the plant floor

The ADAM-3600 is an edge controller that sits between field equipment and the systems that collect its data. Controllers like this are rarely patched on a schedule, and firmware flaws that survive a reflash are the hardest kind to clean up. Advantech's first advisory was dated 12 October and its listing was updated on 15 October; Canada's Cyber Centre published its alert on 20 October.

Updating EdgeLink safely

Because several of the flaws concern the upgrade path itself, how the update is applied matters as much as applying it:

• Update every ADAM-3600 to EdgeLink v2.8.5.0, taking firmware only from Advantech's own download site.
• Until then, keep the controllers' web and management interfaces off untrusted networks, and turn off SafeEnhancement where it is not needed.
• After updating, check that device configuration and firmware match what you expect, since some flaws allowed firmware to be replaced.

Sources

• Advantech: security advisories, Vulnerabilities identified in ADAM-3600 (last updated 2026-10-15), 15 October 2026
• Advantech: ADAM-3600 security advisory (PDF), 12 October 2026
• Canadian Centre for Cyber Security: Advantech security advisory (AV26-1065), 20 October 2026