CERT@VDE published separate advisories for MB connect line and Helmholz products on November 10, 2026.An unauthenticated remote attacker can target a logged-in backend user. If that user interacts with the attack, the attacker may perform critical system actions that affect integrity and availability.
What it allows
How Does CVE-2026-60043 Work?
The weakness is improper input neutralization during web page generation. This lets an unauthenticated remote attacker deliver cross-site scripting content to a backend user who is already logged in.
User interaction is required, so unauthenticated access alone does not complete the chain. Once the logged-in user interacts, the injected content can act through that user's backend session.
CERT@VDE says the resulting actions may include shutting down the server or restoring an uploaded backup. Those outcomes can cause loss of system integrity and availability.
What Do Current Risk Signals Show?
Brandefense Blackhole recorded three Telegram posts mentioning CVE-2026-60043 between August 12 and November 10, 2026. The count shows security-channel attention, but it does not prove successful exploitation.
CISA's November 9, 2026 Known Exploited Vulnerabilities catalog does not list this CVE. Exploitation therefore remains unknown, and teams should prioritize the issue by exposure, affected version, and backend access.
Who is affected
Which Products and Versions Are Affected?
MB connect line's advisory lists mbCONNECT24 and mymbCONNECT24 firmware earlier than 2.21.0. The vendor directs administrators of either product to update the instance to version 2.21.0.
Helmholz lists myREX24V2 and myREX24V2.virtual firmware earlier than 2.21.0. Its separate advisory also directs administrators to update either product to version 2.21.0.
Teams should confirm both the product family and installed firmware during their vulnerability management process. The matching version threshold does not make the two vendor advisories interchangeable.
Timeline
- 2026-11-10
CERT@VDE published VDE-2026-079 and VDE-2026-141; NVD published the CVE record.
What to do
-
Identify exposed product families
Inventory mbCONNECT24, mymbCONNECT24, myREX24V2, and myREX24V2.virtual instances. Record the vendor, product name, firmware version, and backend reachability.
-
Update firmware to version 2.21.0
Apply the matching vendor update to each affected instance. Confirm version 2.21.0 after the maintenance window through the established security patch process.
-
Reduce access while patching
Brandefense recommends limiting backend access to approved administration paths while remediation is pending. Avoid exposing administrative interfaces to untrusted networks.
-
Review backend activity
Brandefense recommends reviewing backend sessions and administrative actions for unexpected shutdown or backup-restore activity. Correlate findings with authenticated user sessions.
-
Validate the change
After updating, confirm the installed firmware and test authorized backend access. Track the work through the vulnerability remediation lifecycle.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-60043?
It is a cross-site scripting vulnerability in four MB connect line and Helmholz remote access products. It can expose critical backend actions through a logged-in user.
Does CVE-2026-60043 require authentication?
The remote attacker does not need authentication. However, the attack must target a backend user who is already logged in, and user interaction is required.
Which versions are affected by CVE-2026-60043?
Firmware earlier than 2.21.0 is affected in mbCONNECT24, mymbCONNECT24, myREX24V2, and myREX24V2.virtual.
How should administrators fix CVE-2026-60043?
CERT@VDE directs administrators to update each affected product to firmware version 2.21.0. Use the advisory that matches the installed vendor and product family.
Sources
- Multiple Vulnerabilities in mbCONNECT24/mymbCONNECT24CERT@VDE
- Multiple Vulnerabilities in myREX24V2/myREX24V2.virtualCERT@VDE
- CVE-2026-60043 DetailNIST National Vulnerability Database
- Known Exploited Vulnerabilities CatalogCISA
