A publicly disclosed local privilege escalation vulnerability in the Linux kernel’s cryptographic subsystem affects ABB Ability Edgenius versions 3.2.0.0 through 3.2.4.0, with a patch now available.
Summary
- CVE-2026-31431 (CVSS 7.8 HIGH) allows a locally authenticated user or compromised container workload to escalate privileges to root on affected ABB Ability Edgenius systems.
- Affected hardware includes the Edgenius Gateway bE100, Gateway E3100C, and Server vE1000 running Edgenius versions 3.2.0.0 up to but not including 3.2.4.1.
- The flaw originates in the Linux kernel’s algif_aead cryptographic algorithm interface and affects most major Linux distributions released since 2017.
- Remote exploitation is not possible — an attacker requires local access via physical presence or valid SSH credentials.
- ABB has released Edgenius 3.2.4.1 to resolve the issue and recommends applying the update at the earliest convenience.
What Has Been Disclosed
CISA republished an advisory from ABB PSIRT on 14 July 2026, covering CVE-2026-31431, a Linux kernel vulnerability affecting the ABB Ability Edgenius edge computing platform. The vulnerability carries a CVSS v3.1 base score of 7.8 (HIGH) and has been publicly disclosed, though ABB reports no known exploitation of Edgenius systems at the time the advisory was issued.
The Underlying Flaw
The vulnerability sits in the Linux kernel’s cryptographic subsystem — specifically the algif_aead interface. An incorrect in-place operation was introduced in which source and destination data mappings were handled differently than intended. This memory handling error can be triggered by invoking the affected cryptographic interface, allowing an attacker to escalate from a standard user account to full root access on the affected system node. The issue is classified under CWE-669 (Incorrect Resource Transfer Between Spheres) and is understood to affect kernels used by most major Linux distributions released since 2017.
Affected Products and Scope
Three ABB Ability Edgenius hardware and software configurations fall within the affected range — versions 3.2.0.0 up to but not including 3.2.4.1 — deployed on the Edgenius Gateway bE100, the Edgenius Gateway E3100C, and the Edgenius Server vE1000. ABB Ability Edgenius is an industrial edge computing platform used to connect to control systems and operational equipment, collect and contextualise operational data, and host applications that deliver real-time insights and AI-driven recommendations. Its deployment context — critical manufacturing environments worldwide — places it squarely within operational technology (OT) infrastructure.
Exploitation Requirements and Realistic Threat Scenarios
Exploitation requires local code execution. An attacker must first obtain local access to the affected system, either through physical presence or via valid SSH credentials. Remote exploitation is not possible. That said, the advisory explicitly notes that the risk increases in shared, containerised, or multi-tenant environments, where a compromised container workload could be the initial foothold. Once root is obtained, the attacker has effective complete control of the system node, including the ability to execute arbitrary code or render the node unavailable.
Mitigating Factors
ABB notes two inherent mitigating factors worth considering during risk assessment. By default, no additional lower-privilege user accounts are present on Edgenius installations, which limits the pool of potential local attackers. Additionally, restricting access to SSH and the Cockpit management interface reduces the attack surface further. These factors do not eliminate the risk but are relevant when organisations are prioritising remediation schedules across a broad asset inventory.
Remediation
ABB has resolved the issue in Edgenius version 3.2.4.1 by incorporating the relevant Linux kernel security update. ABB recommends customers apply this update at their earliest convenience. No workaround is offered as a substitute for patching. CISA also advises that ICS assets be isolated from business networks behind firewalls, that internet-facing exposure be eliminated, and that any required remote access be conducted over a current, patched VPN solution.
Why it matters
For CISOs overseeing OT or industrial environments, a root-level privilege escalation vulnerability on an edge computing platform that interfaces directly with control systems and operational equipment represents a meaningful lateral movement risk. While the local-access requirement limits opportunistic remote exploitation, the reality of shared environments, contractor access, and the increasing use of containerised workloads in industrial settings means the theoretical attacker model is not implausible. Root access on an Edgenius node could allow an adversary to tamper with operational data pipelines, disrupt real-time monitoring, or use the compromised node as a pivot point deeper into the OT network. Organisations operating in critical manufacturing should treat this as a standard-priority patch with an expedited timeline, particularly for internet-adjacent or multi-user deployments.
What to do now
- Identify all ABB Ability Edgenius deployments running versions 3.2.0.0 through 3.2.4.0 across the bE100 Gateway, E3100C Gateway, and vE1000 Server hardware.
- Apply the ABB-released update to Edgenius version 3.2.4.1 at the earliest practicable opportunity.
- In the interim, restrict SSH and Cockpit access to authorised personnel only, and audit existing user accounts on affected nodes.
- Review whether any Edgenius nodes operate in shared, containerised, or multi-tenant configurations and prioritise those for immediate patching.
- Ensure Edgenius systems are isolated from business networks behind firewalls and are not accessible from the internet.
- Where remote access to these systems is necessary, enforce access through a patched and current VPN solution.
- Conduct an impact analysis and risk assessment prior to deploying any defensive measures, in line with CISA guidance.
