Topic · ics-ot

ICS / OT

Industrial Control Systems and Operational Technology — vulnerability advisories and policy affecting Siemens, ABB, Rockwell, Schneider, and the federal facilities that run them.

RSS feed ↗

trade-press
OT coalition urges ISA/IEC 62443 as unified ICS standard
CIRCIA's harmonization exception lets entities skip duplicate reporting, but without a shared OT baseline to measure "substantially similar" against, the exception can't deliver what it promises.
The Operational Technology Cybersecurity Coalition released a July 23 position paper urging federal policymakers to adopt ISA/IEC 62443 as a single horizontal standard for industrial control system security. Operators currently navigate overlapping mandates (the paper cites TSA pipeline security directives and NERC Critical Infrastructure Protection standards as examples) with no shared technical baseline across sectors. Coalition executive director Tatyana Bolton told Inside Cybersecurity that CIRCIA's proposed harmonization exception, which lets entities skip duplicate reporting under a "substantially similar" framework, can't function cleanly for OT until regulators agree on a common standard to measure similarity against.
YESTERDAY
trade-press
CISA Adds Siemens, Schneider to Iran PLC Advisory
The expansion from water-sector PLCs in 2023 to a three-vendor, cross-sector advisory signals CISA now treats Iranian OT targeting as a systematic campaign, not a niche concern.
CISA updated its April 2026 advisory on Iran-affiliated PLC exploitation to add Schneider Electric and Siemens alongside the originally named Rockwell Automation/Allen-Bradley, with "potentially other branded/manufactured PLCs" also in scope. The July 22 update adds detection guidance for malicious code injection in reusable modules. This is the third Iran-linked PLC advisory since December 2023, tracing an arc from sector-specific targeting of water systems to a multi-vendor, cross-sector threat picture across government services, water, and energy.
THU
regulator
Weintek patches cMT3092X HMI privilege-escalation flaws
The fix ships as a standalone patch rather than a firmware update, and engineers must request it directly from Weintek support or distributors.
CISA published an ICS advisory Thursday for four vulnerabilities in the Weintek cMT3092X HMI, deployed in critical manufacturing worldwide. Two flaws (CVE-2026-60134, CVE-2026-61892) carry CVSS 8.8 scores and allow a low-privileged user to escalate to full system control via cookie or token manipulation. A third confirms plaintext password storage (CVE-2026-61886), and a fourth permits modification of read-only data (CVE-2026-60135). The fix, EasyWeb 2.3.17-typeb, bundled in patch cmt_typeB_20260316_007.patch, won't ship as a standard firmware release and must be requested from Weintek support or distributors.
THU
regulator
Rockwell ThinManager Path Traversal Hits Five Sectors
The authentication requirement limits the immediate blast radius, but five critical infrastructure sectors face a privilege-escalation path that demands patching, not postponement.
CISA published an advisory for CVE-2026-11917, a path traversal in Rockwell Automation ThinManager (versions 13.0 through 14.0) that lets an authenticated attacker write arbitrary files to restricted system directories. The CVSS 8.1 flaw affects five critical infrastructure sectors (Chemical, Critical Manufacturing, Energy, Food and Agriculture, and Water and Wastewater) with deployments worldwide. Rockwell has patched all four affected version branches. The authentication requirement buys operators time; this isn't an unauthenticated remote takeover. But the privilege-escalation chain and the deployment footprint across global critical infrastructure mean patching windows should close fast.
THU
regulator
MZ Automation libIEC61850 Hit by Four Critical ICS Flaws
A heap-based buffer overflow in the MMS stack can achieve RCE when ASLR is off, a configuration that's common in embedded substation gear.
CISA issued an advisory covering four vulnerabilities in MZ Automation libIEC61850 versions 1.0.0 through 1.6.1. The library is deployed worldwide across critical manufacturing, energy, and transportation systems. The most severe (CVE-2026-49035, a heap-based buffer overflow in MMS Initiate request handling) carries a CVSS 4.0 score of 9.2 and has demonstrated remote code execution when ASLR is disabled. Two additional flaws allow denial-of-service via crafted GOOSE frames or malformed WriteRequests, and a stack-based buffer overflow in ReadRequest handling rounds out the set. MZ Automation recommends updating to the latest build but hasn't published a patch timeline or backward-compatibility guidance. All four were reported by a single researcher, Abhinav Agarwal.
THU
regulator
MZ Automation lib60870 Flaw Allows Unauthenticated Remote ICS DoS
The out-of-bounds read (CVE-2026-16002, CVSS 8.2) requires no authentication or user interaction; update to version 2.4.1 closes it.
CISA published ICS advisory ICSA-26-204-07 for CVE-2026-16002, an out-of-bounds read (CWE-125) in MZ Automation lib60870 versions 2.4.0 and earlier. The vulnerability carries a CVSS 8.2 score and allows unauthenticated remote attackers to crash the IEC 60870-5-104 parsing process, denying service. Affected sectors include chemical, energy, and water. The fix is a version bump to 2.4.1. No exploitation in the wild has been reported to CISA.
THU
regulator
Panduit IntraVUE Plaintext Passwords Enable OT Segmentation Bypass
A management tool trusted to see everything on the OT network stores passwords in plaintext and hands attackers a CVSS 10.0 path across the IT/OT boundary.
CISA's advisory covers five vulnerabilities in Panduit IntraVUE versions 3.2.1a14 and earlier. The critical is CVE-2026-42933 (CVSS 10.0): an unauthenticated attacker can hijack an active proxy to bypass OT segmentation. CVE-2026-40430 (7.5) exposes plaintext credentials through the API. CVE-2026-28698 (8.6) exposes the underlying host filesystem. CVE-2026-50044 (6.8) enables pass-the-hash attacks on admin credentials via weak encryption. CVE-2026-44955 (5.3) allows unauthenticated asset discovery. Pronetiqs patches all five in version 3.2.1a16. No known exploitation reported. Researcher Phlebas of Lumintel reported the vulnerabilities to CISA.
THU
regulator
Johnson Controls Patches XAAP Android Cleartext Storage Flaw
The vulnerability requires local access or device compromise, not network attack; version 1.53 closes it.
CISA published an advisory for CVE-2026-34490, a cleartext storage vulnerability in Johnson Controls' XAAP Android application affecting versions below 1.53. The flaw stores application data locally without encryption, readable by anyone with physical access to the device or through a separate compromise, no network vector exists. Critical manufacturing sites running XAAP Android should update to version 1.53, which contains the fix. CVSS 3.1 base score is 3.3 (LOW).
THU
regulator
Johnson Controls C-CURE 9000 RCE Reaches Security Workstations
The deserialization bug reaches beyond the server to the desktops of security personnel, and into CISA's ICS advisory stream, not a routine product bulletin.
CISA published an advisory for three vulnerabilities in Johnson Controls' C-CURE 9000 access control and Victor video management systems. The most consequential, CVE-2026-21655 (CVSS 3.1: 8.8), lets an unauthenticated attacker on an adjacent network achieve arbitrary code execution on the application server and on connected client workstations used by physical security personnel. A separate SSRF flaw in Victor Web, CVE-2026-21653 (CVSS 3.1: 9.6), enables forged server-side requests that could allow lateral movement within the network. A third vulnerability, CVE-2026-34496, lets low-privilege users access unauthorized pages including user account details and audit logs. Johnson Controls has released patches: v3.20 or later for C-CURE 9000 and Victor application servers, and v7.0 or later for Victor Web.
THU
trade-press
CISA broadens Iran-linked OT alert to HMI, SCADA displays
For OT teams, the live issue is not attribution; it is whether screens can still be trusted during process control.
CISA and partner agencies revised alert AA26-097A after observed Iran-affiliated activity against internet-facing operational technology included malicious project-file interactions and manipulation of human machine interface and supervisory control and data acquisition displays. State CISOs, municipal IT teams, contractors and managed service providers supporting water, energy, gas and manufacturing sites should review the advisory’s indicators and mitigations, including log checks and removing programmable logic controllers from direct internet exposure.
WED
trade-press
Guard’s Cyber Shield tests power-sector OT with physical components
Power-sector response gets ugly when an intrusion crosses from information technology into equipment that actually moves electricity.
DefenseScoop reports that the National Guard’s 2026 Cyber Shield, running July 12-25 in Little Rock, is focused on defending power-sector operational technology (OT). More than 1,000 troops and civilian experts from 44 U.S. states and territories and 23 international partners are participating. The useful shift is the fully integrated physical component: state teams are rehearsing incidents where an information technology foothold turns into equipment damage and longer outages.
TUE
regulator
CISA flags Tycon TPDIN-Monitor-WEB2 authentication bypass
Tycon's nonresponse leaves network isolation carrying risk that a vendor patch should be reducing for critical manufacturing operators.
The Cybersecurity and Infrastructure Security Agency (CISA) disclosed two flaws in Tycon Systems TPDIN-Monitor-WEB2 2.3.9: CVE-2026-61884, a CVSS v3.1 9.8 authentication bypass using empty login fields, and CVE-2026-55985, a cleartext credential storage flaw scored CVSS v3.1 4.3. The product is deployed worldwide in critical manufacturing. Defense industrial base contractors and Cybersecurity Maturity Model Certification Third-Party Assessment Organizations (C3PAOs) should treat the web interface as immediate operational technology risk, because Tycon did not respond to CISA coordination and no vendor fix is listed.
TUE
regulator
Siemens ships CADRA V2511 while Foxit fixes remain open
The patch closes old library debt, but CISA's mitigation-only rows keep operators from treating V2511 as complete.
Siemens released CADRA V2511, and CISA lists it as the vendor fix for CADRA versions before V2511 affected by zlib CVEs including CVE-2016-9841, CVE-2022-37434 and CVE-2023-45853, each scored 9.8. Primes, subs and contractors using CADRA in chemical, commercial facilities, communications or energy environments should also keep the Foxit-related V8 items open, because CISA lists mitigation only for CVE-2025-10585 and CVE-2025-13223.
TUE
regulator
CISA flags Rockwell 1718/1719 Ex I/O DoS flaw
For plants running version 3.011, the practical work is narrow: schedule firmware 3.012 before a network storm becomes downtime.
CISA published ICSA-26-202-08 for CVE-2026-9140, a Rockwell Automation 1718-AENTR/1719-AENTR Ex I/O denial-of-service flaw affecting version 3.011. Rockwell recommends upgrading to version 3.012 or later. Critical manufacturing operators, including defense-industrial-base primes and subs with these devices, should treat this as a remote, low-complexity availability issue. CISA says it has no reports of known public exploitation.
TUE
regulator
CISA flags Siemens IAM Client privilege-escalation flaw
A medium CVSS score still matters when the vulnerable client sits inside engineering and simulation workflows defense suppliers already trust.
The Cybersecurity and Infrastructure Security Agency republished Siemens ProductCERT SSA-288252 for CVE-2025-40945, a CVSS 6.7 untrusted search path flaw in Siemens IAM Client. The advisory lists 16 affected Siemens products, including COMOS, Designcenter NX, Simcenter, Solid Edge, Teamcenter Visualization and Tecnomatix. Primes, subs and defense-industrial-base operators using those tools in industrial environments should plan coordinated updates, especially where Siemens lists fixes for some products and further fix versions or countermeasures for others.
TUE
regulator
CISA flags Rockwell 1734 POINT I/O DoS flaw
The operational risk is boring but real: a crafted CIP message can turn a standard I/O module into a production stop.
CISA disclosed CVE-2026-10573, a CVSS 7.5 denial-of-service flaw in Rockwell Automation 1734 POINT I/O version 3.023, deployed worldwide in critical manufacturing. Contractors, primes and subs running the module face a remote crafted-CIP-message path to a faulted state; recovery requires manually restarting affected modules. Rockwell recommends migration to 5034-OB8, while CISA’s notice gives no availability date for that replacement.
TUE
regulator
CISA flags Rockwell Studio 5000 path traversal, code execution flaws
Treat ACD project files like executable content until affected engineering workstations move to the corrected Studio 5000 releases.
The Cybersecurity and Infrastructure Security Agency published ICSA-26-202-10 for three Rockwell Automation Studio 5000 Logix Designer vulnerabilities: CVE-2026-9108 path traversal in ACD project-file handling, CVE-2026-9127 incorrect authorization, and CVE-2026-9128 unquoted search path. Affected versions span V32.00 through V36.00. Defense Industrial Base contractors, managed service providers and state chief information security officers supporting critical manufacturing should patch engineering workstations or apply Rockwell's mitigations.
TUE
regulator
CISA flags PAN-OS flaws in Siemens RUGGEDCOM APE1808
Firewall software vulnerabilities become industrial-appliance risk once they ride inside OT network gear.
CISA republished a Siemens ProductCERT advisory for all Siemens RUGGEDCOM APE1808 devices running Palo Alto Networks Virtual NGFW, covering CVE-2026-0266, CVE-2026-0272 and CVE-2026-0273. The flaws include stored cross-site scripting, privilege escalation and OS command injection, with the command-injection bug rated CVSS 7.2. Contractors, defense-industrial-base operators and municipal teams using the appliance should restrict management access and contact support for patch information.
TUE
regulator
CISA flags Siemens SmartPlug flaws rated CVSS 9.8
This is the familiar OT appliance problem: inherited open-source defects become plant-floor exposure on someone else’s patch calendar.
CISA warned that Siemens SIDIS Secured SmartPlug versions before V7.26.0310 carry multiple vulnerabilities in OpenSSL, OpenSSH, hostapd, busybox and other packages, including a CVSS 9.8 issue. Siemens released V7.26.0310 and recommends updating. Contractors, MSPs and ISVs supporting critical manufacturing deployments should treat this as an OT maintenance item, not a paperwork entry.
TUE
regulator
CISA flags JWT forgery in Rockwell FTSP 6.60
Accepting a JSON Web Token algorithm value of `none` is the authentication failure industrial identity plumbing should never ship.
CISA issued ICSA-26-202-07 for CVE-2026-10714, a weak-authentication flaw in Rockwell Automation FactoryTalk Services Platform (FTSP) 6.60. A low-privilege authenticated user can set the JSON Web Token algorithm to `none`, forge tokens, impersonate authorized users, change configurations, and grant permissions to other FTSP-protected systems. Defense suppliers, contractors, and managed service providers running FTSP should apply RAID 1158263 or the February 2026 Patch Roll-up. CISA lists the CVSS 3.1 score as 7.8 High and reports no known public exploitation.
TUE
regulator
CISA flags CVSS 10 Siemens Opcenter X JWT bypass
For OT teams, the practical trigger is network reachability: credentials and user interaction are absent from the attack path.
CISA republished Siemens ProductCERT SSA-096828 for Siemens Opcenter X versions before V2604, assigning CVSS v3.1 10 to CVE-2026-56451. The JWT validation flaw lets an unauthenticated remote attacker forge tokens and impersonate any user, including administrators. Critical manufacturing operators worldwide, including defense industrial base suppliers, municipal IT shops and contractors using Opcenter X, should move to V2604 or isolate affected instances. The advisory gives only general network-exposure guidance, so this is a patch-or-isolate clock.
TUE
trade-press
FCC weighs covered-list hardware ban as NIST convenes AI data center workshop
The useful signal is provenance: certification filings and AI facilities now share a supply-chain security problem.
Inside Cybersecurity reports that the Federal Communications Commission will consider a Wednesday order barring authorization for devices with logic-bearing hardware components made by entities on the FCC’s covered list. An attached notice would propose requiring Software Bill of Materials or Hardware Bill of Materials filings at certification. NIST also holds a two-day AI data center workshop on architecture, training, security posture, supply-chain issues and emerging standards. The common demand is evidence about what is inside the stack before anyone calls it secure.
MON
trade-press
NSA alert puts contractors’ routers back under scrutiny
The warning is less about exotic malware than the old failure: unmanaged edge devices still carry the defense supply chain’s secrets.
Federal News Network reports that the National Security Agency and 18 partner agencies warned critical industries, including the defense industrial base, that Russia-linked hackers are extracting configuration data from poorly secured routers and network devices. Contractors, primes and managed service providers should treat router patching, credential hardening and segmentation as supply-chain controls, not generic IT hygiene. The open question is whether the alert names specific models, firmware or mandatory timelines.
JUL 16
regulator
CISA flags SALTO ProAccess Space partition bypass
Logical tenancy is not a security boundary when one valid operator account can cross every door group it was meant to contain.
CISA published ICSA-26-197-07 for CVE-2026-11889 in SALTO ProAccess Space versions before 6.13. Installations using the tenancy or logical partition feature allow an authenticated operator to bypass authorization and access spaces outside the assigned partition. Contractors, C3PAOs and municipal IT teams using SALTO for multi-tenant facilities should patch to 6.13 and reassess whether partitioning is carrying more trust than it deserves.
JUL 16
regulator
CISA flags AutomationDirect Productivity Suite kernel flaws
Local-only does not mean low-risk when the target is the engineering workstation that programs manufacturing PLCs.
CISA published ICSA-26-197-04 for six AutomationDirect Productivity Suite vulnerabilities affecting versions through v4.6.2.2 in critical manufacturing deployments worldwide. AutomationDirect recommends updating to v4.7.0.47 or later. The flaws require local or physical access, but they reach kernel-level failure modes: privilege escalation, memory corruption, information disclosure and denial of service.
JUL 16
regulator
Rockwell Arena V17.00.01 fixes four out-of-bounds write CVEs
The recurring CWE-787 pattern matters more than the CVE count: inventory Arena installs before malicious files become the delivery mechanism.
CISA published ICSA-26-197-01 for CVE-2026-8085, CVE-2026-8312, CVE-2026-8313 and CVE-2026-8314, four high-severity CWE-787 out-of-bounds write flaws in Rockwell Automation Arena V17.00.00 and earlier. Rockwell recommends updating to V17.00.01. Defense-industrial-base contractors and independent software vendors using Arena in critical manufacturing workflows should treat malicious files as the exploit path; CISA reports no known public exploitation.
JUL 16
regulator
CISA flags three Rockwell Automation controller denial-of-service flaws
For plants running Logix hardware, the operational risk is availability: invalid project or file data can trigger a major nonrecoverable fault.
CISA published ICSA-26-197-06 for CVE-2025-12011, CVE-2025-12012 and CVE-2025-11698, three Rockwell Automation CompactLogix, ControlLogix, GuardLogix and Compact GuardLogix buffer-overflow vulnerabilities. The advisory assigns CVSS v3.1 8.6 and covers critical manufacturing deployments worldwide. Defense primes, subs and other contractors running affected Rockwell controllers should check firmware levels, because exploitation can involve invalid project or file data and push a controller into a major nonrecoverable fault.
JUL 16
regulator
CISA flags Rockwell 1756-EN2, EN3, ENBT DoS flaw
The uncomfortable part is not the CVSS score; it is the discontinued ENBT sitting in plants with no vendor fix.
CISA published ICSA-26-197-02 for CVE-2026-9653, a network-accessible denial-of-service flaw in Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT modules. EN2 and EN3 operators should update to V12.002 or segment control networks; ENBT V6.006 is discontinued and has no fix. CISA says no known public exploitation has been reported.
JUL 16
regulator
CISA flags FactoryTalk DataMosaix XSS, Rockwell urges 8.03
The v3 medium score is the wrong comfort blanket for stored JavaScript that can steal credentials in an ICS-adjacent platform.
CISA issued ICSA-26-197-09 for CVE-2026-9292, a stored cross-site scripting flaw in Rockwell Automation FactoryTalk DataMosaix Private Cloud 8.02 and earlier. Authenticated high-privilege attackers can plant scripts in Workflows configuration, with potential account takeover, credential theft, or malicious redirection. Rockwell recommends upgrading to 8.03 or later; CISA says it has no known public exploitation reports.
JUL 16
regulator
Siemens patches SICAM 8 firmware signature bypass
The hard case is CVE-2026-54799: malicious firmware can outlast the maintenance window that critical infrastructure patching usually gets.
The Cybersecurity and Infrastructure Security Agency warned that Siemens SICAM 8 CPCI85 and SICORE versions before V26.20/V26.20.0 carry four flaws: HTTP-exposed debug code, firmware signature bypass, insecure defaults and weak web API credential checks. Siemens says to update affected CP-8031/CP-8050, CP-8010/CP-8012, SICAM EGS and S8000 packages. Energy, critical manufacturing and defense industrial base operators, plus Cybersecurity Maturity Model Certification Third-Party Assessment Organizations, should focus on CVE-2026-54799 because malicious firmware creates persistence in environments that usually patch slowly.
JUL 16
regulator
CISA flags CVE-2026-12659 in Rockwell Flex 5000 Adapter
The practical risk is recovery: a successful attack means power-cycling the module and associated I/O after crafted Common Industrial Protocol traffic.
CISA issued ICSA-26-197-08 for Rockwell Automation Flex 5000 Adapter 6.011, where CVE-2026-12659 lets crafted Common Industrial Protocol (CIP) packets trigger a denial-of-service condition. Rockwell rates the double-free flaw CVSS 3.1 7.5 and recommends upgrading to 6.012; CISA reported no known public exploitation. Defense-industrial-base primes and suppliers running the adapter in critical manufacturing should plan the firmware move, because recovery requires a power cycle of the module and associated I/O.
JUL 16
regulator
CISA flags NASA cFS HS denial-of-service flaw
Availability is the issue here: exposed cFS HS deployments can be crashed without credentials or user interaction.
CISA published CVE-2026-15352 for NASA Core Flight System Health & Safety application versions before v7.0.1. The NULL pointer dereference can crash the HS application during Housekeeping Telemetry processing, causing denial of service. Organizations running cFS HS modules, including government and defense-industrial-base environments with transportation-system exposure, should update to v7.0.1. CISA reports no known public exploitation.
JUL 16
regulator
ABB patches CVE-2025-13162 in Advant Master Online Builder
A 4.4 CVSS score is the wrong comfort metric when plant-floor local access already means the perimeter failed.
CISA relayed ABB’s patch guidance for CVE-2025-13162, a CVSS 4.4 uncontrolled DLL search-path flaw in Advant Master Online Builder that can permit local code execution. The remediation path covers Control Builder A 1.4/4 and earlier and 800xA for Advant Master 6.0.3-1, 6.1.1-1 through 6.1.1-4, and 6.2.0-1. Primes, contractors and MSPs supporting critical manufacturing sites should update to Control Builder A 1.4/5, 800xA 6.1.1-5, or 6.2.0-3. ABB also withdrew builds after reintroducing or mis-presenting the vulnerable Online Builder.
JUL 14
regulator
ABB patches CVE-2026-31431 in Edgenius industrial gateways
The local-only exploit condition matters less when the affected edge box hosts container workloads inside OT infrastructure.
ABB released Edgenius 3.2.4.1 to fix CVE-2026-31431, a CVSS 7.8 Linux kernel privilege-escalation flaw affecting versions 3.2.0.0 through 3.2.4.0 on bE100, E3100C, and vE1000 systems. Contractors and MSPs supporting critical-manufacturing OT environments should patch exposed Edgenius nodes. ABB says exploitation requires local access or a compromised container workload, which is exactly the detail that keeps this from being a simple perimeter problem.
JUL 14
regulator
CISA flags four ABB T-MAC Plus flaws
Authenticated users on affected industrial networks can reach file disclosure, privilege escalation and authorization-bypass paths before the 4.0-25 fix lands.
CISA published an advisory for four vulnerabilities, CVE-2025-14771 through CVE-2025-14774, in ABB T-MAC Plus 4.0-24. ABB says version 4.0-25 corrects the issues. The highest score is CVSS 9.9, with impacts including sensitive file exfiltration, administrative operations by low-privilege users, stored XSS and a Card Reader service denial of service.
JUL 14
regulator
CISA flags CVSS 10 Rockwell EtherNet/IP adapter takeover flaw
This is the bad OT advisory: network access, no credentials, no user interaction, and commands that can change I/O states.
CISA republished Rockwell Automation advisory SD1785 for CVE-2026-10577, a CVSS 10.0 flaw in 1715-AENTR EtherNet/IP Adapter versions 3.003 and earlier. The exposed debug port allows unauthenticated remote access to intrusive CLI commands, including file deletion, task termination, memory modification, and I/O state changes. Energy, water, critical manufacturing, and contractors or MSPs supporting those environments should upgrade to version 3.011 or reduce network exposure immediately. CISA says it has no reports of public exploitation.
JUL 14
trade-press
FSB Center 16 exploits old Cisco flaws in critical infrastructure
The advisory reads less like new tradecraft than an inventory of unforced errors: weak passwords, exposed portals and obsolete device features.
CyberScoop reports that the National Security Agency and 12 allied governments warned Monday that Russia’s FSB Center 16 is still compromising vulnerable network devices across defense industrial base, communications, energy, finance, government facilities and health care networks. The group has exploited default or weak passwords, Cisco Smart Install, web portals and old Cisco flaws including CVE-2008-4128 and CVE-2018-0171. For defenders, the Monday work is familiar: disable Smart Install, harden authentication and watch local-account logins.
JUL 13
regulator
CISA flags six Schneider PowerChute Serial Shutdown flaws
The fix is straightforward: inventory PowerChute Serial Shutdown 1.4 and earlier, then move Windows and Linux installs to 1.5.
CISA issued an ICS advisory for six vulnerabilities in Schneider Electric PowerChute Serial Shutdown 1.4 and earlier, with a CVSS 3.1 score of 6.1. The flaws include path traversal, credential-reset exposure, denial-of-service conditions and log tampering risks. Contractors, MSPs, ISVs and defense-industrial-base operators using the product in critical infrastructure should upgrade to version 1.5, since the advisory does not identify an interim mitigation that closes every vector.
JUL 9
regulator
Schneider Easergy MiCOM Px40 relays expose device data through SNMP
CVSS 5.3 understates the operational problem when the target is a protection relay deployed across voltage classes.
CISA published ICSA-26-190-03 for CVE-2026-4832, a CVSS 5.3 hard-coded credentials flaw in Schneider Electric Easergy MiCOM Px40 protection relays. Affected firmware spans Px40 models used in medium-, high- and extra-high-voltage systems worldwide, where unauthenticated attackers can interrogate the SNMP port for sensitive device information. Defense Industrial Base sites, municipal operators and contractors should upgrade firmware where SNMP is unnecessary, or isolate relays behind protected networks, firewalls and VPN-controlled remote access. The operational problem is fleet-level reconnaissance across voltage classes.
JUL 9
regulator
CISA flags CVE-2026-14480 in OpenPLC v3
End-of-life software turns a bad authenticated bug into an upgrade mandate, which is tidy advice until the plant cannot move that fast.
CISA published ICSA-26-190-01 for OpenPLC v3, warning that CVE-2026-14480 carries a CVSS 3.1 score of 9.9. The flaw lets an authenticated attacker write arbitrary files and potentially reach native code execution through OpenPLC’s normal compilation process. OpenPLC recommends upgrading to v4 because v3 is end-of-life; CISA says it has no reports of known public exploitation.
JUL 9
regulator
CISA flags Hydro-Québec EV charging backend flaws
The scary part is not EV chargers; it is unauthenticated OCPP plumbing sitting close enough to transportation infrastructure to matter.
CISA published ICSA-26-188-01 for three vulnerabilities in Hydro-Québec's Le Circuit Electrique charging station backend affecting versions before June 2026. CVE-2026-20744 carries a CVSS 3.1 score of 9.8 and could allow privilege escalation through improperly authenticated WebSocket connections; two denial-of-service flaws score 7.5. Operators, managed service providers and public-sector CISOs should verify whether remaining OCPP-dependent stations have Hydro-Québec's authentication mitigations or have disabled OCPP.
JUL 7
regulator
CISA flags Siemens Mendix Studio Pro code-injection CVE-2026-48192
Remediation is uneven: Siemens names two patched trains and gives the remaining affected versions no timetable.
CISA republished Siemens ProductCERT SSA-779310 for CVE-2026-48192, a CVSS 5.4 code-injection flaw triggered when Siemens Mendix Studio Pro processes malicious project files during build pipeline execution. The affected list spans Mendix Studio Pro 10.11 through 10.23, 10.24 before V10.24.21 and 11.0 through 11.11; fixes are listed only for V10.24.21 and V11.6.7. Contractors, independent software vendors and defense-industrial-base teams using Mendix for critical manufacturing or energy applications should treat project files as hostile build inputs.
JUL 7
regulator
CISA flags Proteus 9 memory flaws
The risk sits on engineering workstations that open untrusted Proteus files, making software inventory the first useful control.
CISA published an ICS advisory for three high-severity memory-corruption vulnerabilities in Labcenter Proteus 9.1_SP4_Build_42914: CVE-2026-42953, CVE-2026-49033 and CVE-2026-42958. Successful exploitation could allow arbitrary code execution or information disclosure. Labcenter recommends updating to Proteus 9.2 SP0. CISA says the flaws are not remotely exploitable and has no reports of public exploitation, but defense-industrial-base and other critical-infrastructure users still need to find affected engineering workstations.
JUL 7
regulator
Siemens ships SINEC OS V4.0 for RUGGEDCOM RST2428P flaws
For OT teams, this is inventory-and-change-window work, not a new mandate or an enforcement signal.
CISA issued an Industrial Control Systems advisory for Siemens SINEC OS before V4.0 on RUGGEDCOM RST2428P switches, listing multiple vulnerabilities with a CVSS v3 base score of 9.8. Siemens recommends updating affected devices to V4.0 or later. Defense-industrial-base, municipal and government operators using the switches in critical manufacturing, transportation, energy, healthcare, financial services or government facilities should check exposure before the maintenance window becomes the control failure.
JUL 7
regulator
CVE-2026-10763 exposes PROMOD V traffic over HTTP
The fix is simple on paper, unless a third-party Digipede dependency turns HTTPS into a scheduling problem.
CISA republished Hitachi Energy’s advisory for CVE-2026-10763, a CVSS 7.1 flaw in PROMOD V 1.0.10 and earlier that sends sensitive data over HTTP instead of HTTPS. Energy-sector operators should upgrade to PROMOD V 1.0.11 and enable HTTPS on Digipede servers. CISA’s notice does not say how many U.S. utilities run affected versions or when upgrades will be complete.
JUL 7
regulator
Hitachi Energy e-mesh EMS carries CVE-2026-42945 NGINX overflow
The fix list is simple, but the hotfix timing is not, which is how OT patch queues get ugly.
CISA republished Hitachi Energy’s advisory for CVE-2026-42945, an NGINX heap-based buffer overflow affecting e-mesh EMS 4.1.6, 4.4.2 and 4.7.0. The worldwide energy-sector footprint matters to DIB primes and state CISOs with OT dependencies. The immediate work is concrete: patch NGINX to v1.30.2 or later, keep ASLR active, check rewrite rules, and address Ubuntu 20.04 LTS exposure.
JUL 7
regulator
Digi PortServer TS and Digi One devices face auth bypass and XSS
Aging OT management interfaces leave operators fixing exposure at the network boundary while Digi points affected products toward replacement.
CISA issued ICSA-26-188-07 for CVE-2026-12352 and CVE-2026-12948 in Digi PortServer TS, Digi One SP, Digi One SP IA and Digi One IA devices before Firmware_2025. The advisory reaches worldwide deployments in critical manufacturing, communications, information technology and transportation systems. Digi tells PortServer TS users to enable HTTPS or disable the web server, and Digi One users to disable it or restrict access through firewall or VPN. For the stored cross-site scripting flaw, Digi says no firmware fix is coming and points operators to replacement hardware. CISA reports no known public exploitation.
JUL 7
regulator
CISA flags Gardyn IoT Hub flaws at CVSS 10
Hard-coded cloud keys and public device logs are table-stakes failures when the device manages food and agriculture operations.
CISA published ICSA-26-183-03 for three Gardyn IoT Hub vulnerabilities affecting Home and Studio firmware below master.627 and Cloud API below 2.12.2026. The worst, CVE-2026-13768, carries CVSS 10 and exposes a privileged iothubowner key that can return connection information, execute commands on connected devices, and support network pivoting. Gardyn says deployed IoT Hub infrastructure has been updated, but customers must connect devices for automatic firmware updates and update the mobile app.
JUL 2
regulator
CISA flags CVE-2026-13743 in CubeSpace reaction wheels
The medium score hides the useful detail: secure boot arrives only after operators install 5.0.20 and turn it on.
CISA published CVE-2026-13743 for CubeSpace CW0057 reaction wheels running firmware before 5.0.20, a CVSS v3.1 6.1 Medium flaw allowing a physical-access attacker to upload malicious firmware without authentication. Space-adjacent operators, including defense-industrial-base and state security teams tracking communications assets, should patch and manually enable signed boot, preferably fully immutable mode. CubeSpace calls practical risk low, but optional secure boot keeps the hard part on the operator.
JUL 2
regulator
CISA warns iDirect iQ-Series flaws expose satellite authentication credentials
The dangerous part is the identity layer: extracted DID and TPK values can support impersonation and reconnaissance.
CISA issued ICSA-26-183-01 for ST Engineering iDirect Evolution iQ, 3315 and 9-Series terminals running 4.5.2.1 or earlier. CVE-2026-38059 exposes API endpoints without authentication, letting attackers with network access retrieve DID and TPK values used for satellite network authentication. CVE-2026-38057 lets a malicious page trigger reboots through CSRF. Defense Industrial Base contractors, state CISOs and critical infrastructure operators should update to 4.5.2.2, restrict management interfaces and watch for anomalous API activity or unexpected reboots.
JUL 2