Yokogawa CENTUM VP Operator Station Flaw Enables Remote Code Execution via Malicious Graphics Macro Injection (CVE-2026-80840)

Advisory Summary

Yokogawa Electric Corporation has issued an emergency cybersecurity notification (YSAR-26-0004) alerting critical infrastructure operators to CVE-2026-80840 (CVSS score 9.6), a critical remote code execution flaw in CENTUM VP Human Interface Station (HIS) software.

CENTUM VP is one of the world's most widely deployed Distributed Control Systems (DCS), managing process automation across major oil refineries, liquefied natural gas (LNG) terminals, chemical plants, and power generation facilities globally. The vulnerability permits an attacker to execute arbitrary machine code on operator consoles with full local administrative privileges.

Root Cause: Unsafe Graphic Macro Deserialization

The vulnerability exists within the Graphic Display Service (BKHOprGph.exe), which manages the real-time visualization of process flow diagrams, valve positions, and alarm annunciators across operator consoles.

When an operator navigates to a graphic display window, the HIS service dynamically fetches compiled macro byte arrays over the control network via TCP port 50014. The binary parser failed to perform bounds checks or type validation before loading embedded executable objects, allowing an unauthenticated attacker on the supervisory network to inject shellcode that executes within the high-privilege SYSTEM context.

Operational Impact on Process Plants

Successful compromise of an HIS operator workstation provides adversaries with complete control over physical plant visualization and manual override capabilities:

• Blinding Operators: Attackers can freeze telemetry displays to show normal valve pressures and liquid levels while simultaneously sending destructive commands to Field Control Stations (FCS).
• FCS Logic Tampering: From a compromised HIS console, attackers can download modified ladder logic or function block diagrams directly to physical controllers over the Vnet/IP bus.
• Safety Valve Manipulation: Threat actors can force emergency shutdown valves (ESD) closed or override interlocks, risking physical overpressure events.

Industrial Remediation & Defense Playbook (IEC 62443 Standards)

Process automation engineers and DCS administrators must execute the following remediation steps:

1. Apply Official Yokogawa Patches: Install Patch Rollup YSAR-26-0004-P1 or upgrade to CENTUM VP R6.11.00 immediately on all engineering workstations and HIS operator consoles.
2. Vnet/IP and Control Network Segmentation (IEC 62443-3-2): Enforce strict firewall boundaries between Level 3 operations and Level 2 control systems. Block TCP port 50014 from all corporate and external networks.
3. Workstation Application Whitelisting: Enable Windows Defender Application Control (WDAC) or industrial endpoint whitelisting on all HIS machines to prevent unauthorized binaries or DLLs from executing.
4. Monitor for Rogue Macro Artifacts: Audit the C:\Yokogawa\CentumVP\Graphics\ directory for unexpected or recently modified graphic display definition files.