TL;DR Phoenix Contact disclosed three vulnerabilities in PLCnext firmware on August 12, 2026. One flaw, CVE-2025-41771, lets a low-privileged attacker execute unauthorized SQL queries. A second, critical bug scores a CVSS 9.8 and allows remote code execution. Why it matters PLCnext controllers run factory and infrastructure automation. So flaws here can disrupt physical processes. The most severe bug needs no login at all.