Skip to content
OpenAdvisories
Critical VDE-2026-051 1 CVE

iba: Deserialization vulnerability in ibaPDA and ibaDatCoordinator

Published Jun 17, 2026 · Updated Sep 17, 2026 · Revision 3

Vendor: iba Product: 4.0.7 Product: 5.7.3 Product: ibaDatCoordinator Product: ibaLogic Product: ibaPDA

Summary

A vulnerability has been identified in ibaPDA, ibaDatCoordinator and ibaLogic. The affected applications do not properly restrict the .NET BinaryFormatter when deserializing client-server input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected applications. This is the same issue that exists for the .NET BinaryFormatter: https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300.

Details

Impact
Remote Code Execution (RCE) running under the service user account, thereby allowing privilege escalation.

Mitigation
Restrict connections to localhost
For ibaPDA and ibaDatCoordinator
- (Info: Applies only to ibaPDA. For ibaDatCoordinator, continue with the next step.) Go to I/O Manager → General and deactivate the option "Automatically open necessary ports in Windows Firewall." (If this option remains active, after a restart of ibaPDA or a restart for data acquisition, the firewall will be reconfigured automatically.)
- Then go to Advanced Windows Firewall settings and delete or deactivate all incoming rules for the ibaPDA / ibaDatCoordinator Client and Server.
- Create manual firewall rules for the connection you use for ibaPDA or ibaDatCoordinator and verify that you have the correct ports configured. Help regarding which ports the ibaPDA or ibaDatCoordinator Service uses can be found in the iba Help Center.

For ibaLogic:
- Go to Advanced Windows Firewall settings to incoming rules.
- Go to the properties of "ibaLogic 5 remoting Connection". => Set in General: "Block the connection".

Important: After the change, verify that all ibaPDA or ibaDatCoordinator services are working as expected and that the data acquisition is functioning correctly.

Remediation
Update to the fixed versions listed below:
- ibaPDA v8.14.0
- ibaDatCoordinator v4.0.7
- ibaLogic v5.7.3

Vulnerabilities 1

  • Critical 9.8
    CVE-2026-8024

    Deserialization vulnerability in ibaPDA and ibaDatCoordinator

    A remote, unauthenticated attacker may exploit a deserialization of untrusted data vulnerability in ibaPDA or ibaDatCoordinator to gain full access to the affected systems.

    iba ibaDatCoordinator ibaPDA

Revision history

  1. #3.0.0

    Corrected all CPE numbers and vendor name of all products.

  2. #2.0.0

    Added ibaLogic to the affected products and the mitigation for this product.

  3. #1.0.0

    Initial revision

References