Bosch Rexroth PRI7000 Updates Bundled 7-Zip for CVE-2026-14266
Tech GuruQuick Answer
Bosch published BOSCH-SA-069646 for PRI7000 installations bundling 7-Zip 26.01 or older. Match each engineering station to its PRI7000 branch, deploy the listed fixed branch release, validate project and device workflows, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory PRI7000 engineering stations and portable 7-Zip copies, identify the installed branch, deploy PRI7000 1.11.17.3, 1.11.18.3, or 1.11.19.1 or later as applicable, restrict untrusted archives, and validate representative engineering workflows.
Last verified: 2026-10-12 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Bosch Rexroth PRI7000 engineering software |
|---|---|
| Advisory | BOSCH-SA-069646 |
| CVE | CVE-2026-14266 |
| Authoritative release date | 2026-10-12 00:00:00 UTC |
| Authority revision date | 2026-10-12 14:23:06 UTC |
| Affected versions | PRI7000 branches before 1.11.17.3, before 1.11.18.3, and before 1.11.19.1, as mapped by the Bosch advisory. |
| Fixed version | PRI7000 1.11.17.3, 1.11.18.3, or 1.11.19.1 or later for the matching branch |
| CVSS base score | 7.0 (CVSS v3.0) |
| CVSS severity | High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
Bosch reported that the portable 7-Zip component bundled with PRI7000 can be exploited directly on a customer PC through crafted XZ data, enabling code execution in the current user's context; PRI7000 does not provide an indirect exploitation path.
What To Validate Now
- Inventory. Locate Bosch Rexroth PRI7000 engineering software deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: PRI7000 branches before 1.11.17.3, before 1.11.18.3, and before 1.11.19.1, as mapped by the Bosch advisory. Do not infer applicability from product family or severity alone.
- Remediate. Apply PRI7000 1.11.17.3, 1.11.18.3, or 1.11.19.1 or later for the matching branch through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the resulting version or managed-service state, exercise representative functionality and recovery paths, monitor for regressions, and document exceptions.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Exploitation requires the bundled component to process crafted XZ data and user interaction may be required. Do not assume the PRI7000 application itself exposes the vulnerable parser remotely; validate local engineering-station exposure and branch selection. Preserve the authority snapshot, asset and owner records, before-and-after versions, change approval, installation output, validation results, exceptions, and rollback evidence.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
