Topic · vendor-advisory

Vendor advisory

Vendor-issued security advisories for specific products (Cisco, Microsoft, Siemens, Fortinet, ABB). Pairs with vuln-advisory when CISA mirrors the vendor advisory.

RSS feed ↗

regulator
Weintek patches cMT3092X HMI privilege-escalation flaws
The fix ships as a standalone patch rather than a firmware update, and engineers must request it directly from Weintek support or distributors.
CISA published an ICS advisory Thursday for four vulnerabilities in the Weintek cMT3092X HMI, deployed in critical manufacturing worldwide. Two flaws (CVE-2026-60134, CVE-2026-61892) carry CVSS 8.8 scores and allow a low-privileged user to escalate to full system control via cookie or token manipulation. A third confirms plaintext password storage (CVE-2026-61886), and a fourth permits modification of read-only data (CVE-2026-60135). The fix, EasyWeb 2.3.17-typeb, bundled in patch cmt_typeB_20260316_007.patch, won't ship as a standard firmware release and must be requested from Weintek support or distributors.
THU
regulator
Rockwell ThinManager Path Traversal Hits Five Sectors
The authentication requirement limits the immediate blast radius, but five critical infrastructure sectors face a privilege-escalation path that demands patching, not postponement.
CISA published an advisory for CVE-2026-11917, a path traversal in Rockwell Automation ThinManager (versions 13.0 through 14.0) that lets an authenticated attacker write arbitrary files to restricted system directories. The CVSS 8.1 flaw affects five critical infrastructure sectors (Chemical, Critical Manufacturing, Energy, Food and Agriculture, and Water and Wastewater) with deployments worldwide. Rockwell has patched all four affected version branches. The authentication requirement buys operators time; this isn't an unauthenticated remote takeover. But the privilege-escalation chain and the deployment footprint across global critical infrastructure mean patching windows should close fast.
THU
regulator
MZ Automation libIEC61850 Hit by Four Critical ICS Flaws
A heap-based buffer overflow in the MMS stack can achieve RCE when ASLR is off, a configuration that's common in embedded substation gear.
CISA issued an advisory covering four vulnerabilities in MZ Automation libIEC61850 versions 1.0.0 through 1.6.1. The library is deployed worldwide across critical manufacturing, energy, and transportation systems. The most severe (CVE-2026-49035, a heap-based buffer overflow in MMS Initiate request handling) carries a CVSS 4.0 score of 9.2 and has demonstrated remote code execution when ASLR is disabled. Two additional flaws allow denial-of-service via crafted GOOSE frames or malformed WriteRequests, and a stack-based buffer overflow in ReadRequest handling rounds out the set. MZ Automation recommends updating to the latest build but hasn't published a patch timeline or backward-compatibility guidance. All four were reported by a single researcher, Abhinav Agarwal.
THU
regulator
Panduit IntraVUE Plaintext Passwords Enable OT Segmentation Bypass
A management tool trusted to see everything on the OT network stores passwords in plaintext and hands attackers a CVSS 10.0 path across the IT/OT boundary.
CISA's advisory covers five vulnerabilities in Panduit IntraVUE versions 3.2.1a14 and earlier. The critical is CVE-2026-42933 (CVSS 10.0): an unauthenticated attacker can hijack an active proxy to bypass OT segmentation. CVE-2026-40430 (7.5) exposes plaintext credentials through the API. CVE-2026-28698 (8.6) exposes the underlying host filesystem. CVE-2026-50044 (6.8) enables pass-the-hash attacks on admin credentials via weak encryption. CVE-2026-44955 (5.3) allows unauthenticated asset discovery. Pronetiqs patches all five in version 3.2.1a16. No known exploitation reported. Researcher Phlebas of Lumintel reported the vulnerabilities to CISA.
THU
regulator
Johnson Controls C-CURE 9000 RCE Reaches Security Workstations
The deserialization bug reaches beyond the server to the desktops of security personnel, and into CISA's ICS advisory stream, not a routine product bulletin.
CISA published an advisory for three vulnerabilities in Johnson Controls' C-CURE 9000 access control and Victor video management systems. The most consequential, CVE-2026-21655 (CVSS 3.1: 8.8), lets an unauthenticated attacker on an adjacent network achieve arbitrary code execution on the application server and on connected client workstations used by physical security personnel. A separate SSRF flaw in Victor Web, CVE-2026-21653 (CVSS 3.1: 9.6), enables forged server-side requests that could allow lateral movement within the network. A third vulnerability, CVE-2026-34496, lets low-privilege users access unauthorized pages including user account details and audit logs. Johnson Controls has released patches: v3.20 or later for C-CURE 9000 and Victor application servers, and v7.0 or later for Victor Web.
THU
regulator
Siemens ships CADRA V2511 while Foxit fixes remain open
The patch closes old library debt, but CISA's mitigation-only rows keep operators from treating V2511 as complete.
Siemens released CADRA V2511, and CISA lists it as the vendor fix for CADRA versions before V2511 affected by zlib CVEs including CVE-2016-9841, CVE-2022-37434 and CVE-2023-45853, each scored 9.8. Primes, subs and contractors using CADRA in chemical, commercial facilities, communications or energy environments should also keep the Foxit-related V8 items open, because CISA lists mitigation only for CVE-2025-10585 and CVE-2025-13223.
TUE
regulator
CISA flags Rockwell 1718/1719 Ex I/O DoS flaw
For plants running version 3.011, the practical work is narrow: schedule firmware 3.012 before a network storm becomes downtime.
CISA published ICSA-26-202-08 for CVE-2026-9140, a Rockwell Automation 1718-AENTR/1719-AENTR Ex I/O denial-of-service flaw affecting version 3.011. Rockwell recommends upgrading to version 3.012 or later. Critical manufacturing operators, including defense-industrial-base primes and subs with these devices, should treat this as a remote, low-complexity availability issue. CISA says it has no reports of known public exploitation.
TUE
regulator
CISA flags Siemens IAM Client privilege-escalation flaw
A medium CVSS score still matters when the vulnerable client sits inside engineering and simulation workflows defense suppliers already trust.
The Cybersecurity and Infrastructure Security Agency republished Siemens ProductCERT SSA-288252 for CVE-2025-40945, a CVSS 6.7 untrusted search path flaw in Siemens IAM Client. The advisory lists 16 affected Siemens products, including COMOS, Designcenter NX, Simcenter, Solid Edge, Teamcenter Visualization and Tecnomatix. Primes, subs and defense-industrial-base operators using those tools in industrial environments should plan coordinated updates, especially where Siemens lists fixes for some products and further fix versions or countermeasures for others.
TUE
regulator
CISA flags Rockwell 1734 POINT I/O DoS flaw
The operational risk is boring but real: a crafted CIP message can turn a standard I/O module into a production stop.
CISA disclosed CVE-2026-10573, a CVSS 7.5 denial-of-service flaw in Rockwell Automation 1734 POINT I/O version 3.023, deployed worldwide in critical manufacturing. Contractors, primes and subs running the module face a remote crafted-CIP-message path to a faulted state; recovery requires manually restarting affected modules. Rockwell recommends migration to 5034-OB8, while CISA’s notice gives no availability date for that replacement.
TUE
regulator
CISA flags Rockwell Studio 5000 path traversal, code execution flaws
Treat ACD project files like executable content until affected engineering workstations move to the corrected Studio 5000 releases.
The Cybersecurity and Infrastructure Security Agency published ICSA-26-202-10 for three Rockwell Automation Studio 5000 Logix Designer vulnerabilities: CVE-2026-9108 path traversal in ACD project-file handling, CVE-2026-9127 incorrect authorization, and CVE-2026-9128 unquoted search path. Affected versions span V32.00 through V36.00. Defense Industrial Base contractors, managed service providers and state chief information security officers supporting critical manufacturing should patch engineering workstations or apply Rockwell's mitigations.
TUE
regulator
CISA flags PAN-OS flaws in Siemens RUGGEDCOM APE1808
Firewall software vulnerabilities become industrial-appliance risk once they ride inside OT network gear.
CISA republished a Siemens ProductCERT advisory for all Siemens RUGGEDCOM APE1808 devices running Palo Alto Networks Virtual NGFW, covering CVE-2026-0266, CVE-2026-0272 and CVE-2026-0273. The flaws include stored cross-site scripting, privilege escalation and OS command injection, with the command-injection bug rated CVSS 7.2. Contractors, defense-industrial-base operators and municipal teams using the appliance should restrict management access and contact support for patch information.
TUE
regulator
CISA flags Siemens SmartPlug flaws rated CVSS 9.8
This is the familiar OT appliance problem: inherited open-source defects become plant-floor exposure on someone else’s patch calendar.
CISA warned that Siemens SIDIS Secured SmartPlug versions before V7.26.0310 carry multiple vulnerabilities in OpenSSL, OpenSSH, hostapd, busybox and other packages, including a CVSS 9.8 issue. Siemens released V7.26.0310 and recommends updating. Contractors, MSPs and ISVs supporting critical manufacturing deployments should treat this as an OT maintenance item, not a paperwork entry.
TUE
regulator
CISA flags JWT forgery in Rockwell FTSP 6.60
Accepting a JSON Web Token algorithm value of `none` is the authentication failure industrial identity plumbing should never ship.
CISA issued ICSA-26-202-07 for CVE-2026-10714, a weak-authentication flaw in Rockwell Automation FactoryTalk Services Platform (FTSP) 6.60. A low-privilege authenticated user can set the JSON Web Token algorithm to `none`, forge tokens, impersonate authorized users, change configurations, and grant permissions to other FTSP-protected systems. Defense suppliers, contractors, and managed service providers running FTSP should apply RAID 1158263 or the February 2026 Patch Roll-up. CISA lists the CVSS 3.1 score as 7.8 High and reports no known public exploitation.
TUE
regulator
CISA flags CVSS 10 Siemens Opcenter X JWT bypass
For OT teams, the practical trigger is network reachability: credentials and user interaction are absent from the attack path.
CISA republished Siemens ProductCERT SSA-096828 for Siemens Opcenter X versions before V2604, assigning CVSS v3.1 10 to CVE-2026-56451. The JWT validation flaw lets an unauthenticated remote attacker forge tokens and impersonate any user, including administrators. Critical manufacturing operators worldwide, including defense industrial base suppliers, municipal IT shops and contractors using Opcenter X, should move to V2604 or isolate affected instances. The advisory gives only general network-exposure guidance, so this is a patch-or-isolate clock.
TUE
standards
Microsoft patches 40-plus products, including SQL and LSASS
The hard part is not deciding whether to patch, but sequencing domain, database, endpoint and customer environments without leaving crown jewels exposed.
Microsoft issued September 9 patches for more than 40 products, with MS-ISAC warning that the most severe vulnerabilities could allow remote code execution. Contractors, primes, subs and managed service providers should prioritize SQL Server, Windows PowerShell, Office, LSASS and SMBv3 exposures. MS-ISAC says it has no reports of exploitation in the wild, but the advisory does not specify CVSS scores, exploit timing or Windows Server 2019 and 2022 patch coverage.
MON
regulator
CISA flags AutomationDirect Productivity Suite kernel flaws
Local-only does not mean low-risk when the target is the engineering workstation that programs manufacturing PLCs.
CISA published ICSA-26-197-04 for six AutomationDirect Productivity Suite vulnerabilities affecting versions through v4.6.2.2 in critical manufacturing deployments worldwide. AutomationDirect recommends updating to v4.7.0.47 or later. The flaws require local or physical access, but they reach kernel-level failure modes: privilege escalation, memory corruption, information disclosure and denial of service.
JUL 16
regulator
Rockwell Arena V17.00.01 fixes four out-of-bounds write CVEs
The recurring CWE-787 pattern matters more than the CVE count: inventory Arena installs before malicious files become the delivery mechanism.
CISA published ICSA-26-197-01 for CVE-2026-8085, CVE-2026-8312, CVE-2026-8313 and CVE-2026-8314, four high-severity CWE-787 out-of-bounds write flaws in Rockwell Automation Arena V17.00.00 and earlier. Rockwell recommends updating to V17.00.01. Defense-industrial-base contractors and independent software vendors using Arena in critical manufacturing workflows should treat malicious files as the exploit path; CISA reports no known public exploitation.
JUL 16
regulator
CISA flags three Rockwell Automation controller denial-of-service flaws
For plants running Logix hardware, the operational risk is availability: invalid project or file data can trigger a major nonrecoverable fault.
CISA published ICSA-26-197-06 for CVE-2025-12011, CVE-2025-12012 and CVE-2025-11698, three Rockwell Automation CompactLogix, ControlLogix, GuardLogix and Compact GuardLogix buffer-overflow vulnerabilities. The advisory assigns CVSS v3.1 8.6 and covers critical manufacturing deployments worldwide. Defense primes, subs and other contractors running affected Rockwell controllers should check firmware levels, because exploitation can involve invalid project or file data and push a controller into a major nonrecoverable fault.
JUL 16
regulator
CISA flags Rockwell 1756-EN2, EN3, ENBT DoS flaw
The uncomfortable part is not the CVSS score; it is the discontinued ENBT sitting in plants with no vendor fix.
CISA published ICSA-26-197-02 for CVE-2026-9653, a network-accessible denial-of-service flaw in Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT modules. EN2 and EN3 operators should update to V12.002 or segment control networks; ENBT V6.006 is discontinued and has no fix. CISA says no known public exploitation has been reported.
JUL 16
regulator
CISA flags FactoryTalk DataMosaix XSS, Rockwell urges 8.03
The v3 medium score is the wrong comfort blanket for stored JavaScript that can steal credentials in an ICS-adjacent platform.
CISA issued ICSA-26-197-09 for CVE-2026-9292, a stored cross-site scripting flaw in Rockwell Automation FactoryTalk DataMosaix Private Cloud 8.02 and earlier. Authenticated high-privilege attackers can plant scripts in Workflows configuration, with potential account takeover, credential theft, or malicious redirection. Rockwell recommends upgrading to 8.03 or later; CISA says it has no known public exploitation reports.
JUL 16
regulator
Siemens patches SICAM 8 firmware signature bypass
The hard case is CVE-2026-54799: malicious firmware can outlast the maintenance window that critical infrastructure patching usually gets.
The Cybersecurity and Infrastructure Security Agency warned that Siemens SICAM 8 CPCI85 and SICORE versions before V26.20/V26.20.0 carry four flaws: HTTP-exposed debug code, firmware signature bypass, insecure defaults and weak web API credential checks. Siemens says to update affected CP-8031/CP-8050, CP-8010/CP-8012, SICAM EGS and S8000 packages. Energy, critical manufacturing and defense industrial base operators, plus Cybersecurity Maturity Model Certification Third-Party Assessment Organizations, should focus on CVE-2026-54799 because malicious firmware creates persistence in environments that usually patch slowly.
JUL 16
vendor
AsyncAPI npm compromise bypasses install-script defenses
Import-time execution turns a familiar npm incident into a CI/CD credential problem, because clean installs alone do not remove exposure.
Microsoft says five versions across four @asyncapi npm packages were republished on July 14 with the same malicious loader, affecting systems that resolved and imported them during a roughly 90-minute window. The payload ran on import or require, so npm install --ignore-scripts did not help. Teams should remove the versions, purge npm and Yarn caches, hunt for sync.js, block 85.137.53[.]71 on ports 8080, 8081 and 8091, and rotate credentials reachable from affected environments.
JUL 15
trade-press
CISA adds exploited SonicWall SMA1000 zero-days to KEV
SMA1000 operators need to upgrade, check SonicWall’s indicators of compromise, and treat suspicious activity as a live intrusion.
SonicWall disclosed CVE-2026-15409 and CVE-2026-15410 for SMA1000 appliances Tuesday, and CISA added both to the Known Exploited Vulnerabilities catalog the same day. Rapid7 told CyberScoop exploitation began June 22 and likely aimed at ransomware. SonicWall says fewer than 5,000 SMA1000 units sit within its roughly one million monitored sensors, but also warned customers that patching alone is insufficient.
JUL 15
standards
CIS flags CVE-2025-48703 pre-auth RCE in CWP
A free hosting control panel becomes a server takeover path when the admin surface stays internet-facing and unpatched.
CIS MS-ISAC advisory 2025-100 warns that CWP, also known as Control Web Panel or CentOS Web Panel, before 0.9.8.1205 allows unauthenticated remote code execution through shell metacharacters in filemanager changePerm requests. Primes, subs and municipal IT shops running CWP should patch after testing. Public proof-of-concept code means the safe assumption is scanning, not theory.
JUL 14
regulator
ABB patches CVE-2025-13162 in Advant Master Online Builder
A 4.4 CVSS score is the wrong comfort metric when plant-floor local access already means the perimeter failed.
CISA relayed ABB’s patch guidance for CVE-2025-13162, a CVSS 4.4 uncontrolled DLL search-path flaw in Advant Master Online Builder that can permit local code execution. The remediation path covers Control Builder A 1.4/4 and earlier and 800xA for Advant Master 6.0.3-1, 6.1.1-1 through 6.1.1-4, and 6.2.0-1. Primes, contractors and MSPs supporting critical manufacturing sites should update to Control Builder A 1.4/5, 800xA 6.1.1-5, or 6.2.0-3. ABB also withdrew builds after reintroducing or mis-presenting the vulnerable Online Builder.
JUL 14
regulator
CISA flags four ABB T-MAC Plus flaws
Authenticated users on affected industrial networks can reach file disclosure, privilege escalation and authorization-bypass paths before the 4.0-25 fix lands.
CISA published an advisory for four vulnerabilities, CVE-2025-14771 through CVE-2025-14774, in ABB T-MAC Plus 4.0-24. ABB says version 4.0-25 corrects the issues. The highest score is CVSS 9.9, with impacts including sensitive file exfiltration, administrative operations by low-privilege users, stored XSS and a Card Reader service denial of service.
JUL 14
regulator
CISA flags CVSS 10 Rockwell EtherNet/IP adapter takeover flaw
This is the bad OT advisory: network access, no credentials, no user interaction, and commands that can change I/O states.
CISA republished Rockwell Automation advisory SD1785 for CVE-2026-10577, a CVSS 10.0 flaw in 1715-AENTR EtherNet/IP Adapter versions 3.003 and earlier. The exposed debug port allows unauthenticated remote access to intrusive CLI commands, including file deletion, task termination, memory modification, and I/O state changes. Energy, water, critical manufacturing, and contractors or MSPs supporting those environments should upgrade to version 3.011 or reduce network exposure immediately. CISA says it has no reports of public exploitation.
JUL 14
regulator
CISA flags six Schneider PowerChute Serial Shutdown flaws
The fix is straightforward: inventory PowerChute Serial Shutdown 1.4 and earlier, then move Windows and Linux installs to 1.5.
CISA issued an ICS advisory for six vulnerabilities in Schneider Electric PowerChute Serial Shutdown 1.4 and earlier, with a CVSS 3.1 score of 6.1. The flaws include path traversal, credential-reset exposure, denial-of-service conditions and log tampering risks. Contractors, MSPs, ISVs and defense-industrial-base operators using the product in critical infrastructure should upgrade to version 1.5, since the advisory does not identify an interim mitigation that closes every vector.
JUL 9
regulator
Schneider Easergy MiCOM Px40 relays expose device data through SNMP
CVSS 5.3 understates the operational problem when the target is a protection relay deployed across voltage classes.
CISA published ICSA-26-190-03 for CVE-2026-4832, a CVSS 5.3 hard-coded credentials flaw in Schneider Electric Easergy MiCOM Px40 protection relays. Affected firmware spans Px40 models used in medium-, high- and extra-high-voltage systems worldwide, where unauthenticated attackers can interrogate the SNMP port for sensitive device information. Defense Industrial Base sites, municipal operators and contractors should upgrade firmware where SNMP is unnecessary, or isolate relays behind protected networks, firewalls and VPN-controlled remote access. The operational problem is fleet-level reconnaissance across voltage classes.
JUL 9
regulator
CISA flags Siemens Mendix Studio Pro code-injection CVE-2026-48192
Remediation is uneven: Siemens names two patched trains and gives the remaining affected versions no timetable.
CISA republished Siemens ProductCERT SSA-779310 for CVE-2026-48192, a CVSS 5.4 code-injection flaw triggered when Siemens Mendix Studio Pro processes malicious project files during build pipeline execution. The affected list spans Mendix Studio Pro 10.11 through 10.23, 10.24 before V10.24.21 and 11.0 through 11.11; fixes are listed only for V10.24.21 and V11.6.7. Contractors, independent software vendors and defense-industrial-base teams using Mendix for critical manufacturing or energy applications should treat project files as hostile build inputs.
JUL 7
regulator
CISA flags Proteus 9 memory flaws
The risk sits on engineering workstations that open untrusted Proteus files, making software inventory the first useful control.
CISA published an ICS advisory for three high-severity memory-corruption vulnerabilities in Labcenter Proteus 9.1_SP4_Build_42914: CVE-2026-42953, CVE-2026-49033 and CVE-2026-42958. Successful exploitation could allow arbitrary code execution or information disclosure. Labcenter recommends updating to Proteus 9.2 SP0. CISA says the flaws are not remotely exploitable and has no reports of public exploitation, but defense-industrial-base and other critical-infrastructure users still need to find affected engineering workstations.
JUL 7
regulator
Siemens ships SINEC OS V4.0 for RUGGEDCOM RST2428P flaws
For OT teams, this is inventory-and-change-window work, not a new mandate or an enforcement signal.
CISA issued an Industrial Control Systems advisory for Siemens SINEC OS before V4.0 on RUGGEDCOM RST2428P switches, listing multiple vulnerabilities with a CVSS v3 base score of 9.8. Siemens recommends updating affected devices to V4.0 or later. Defense-industrial-base, municipal and government operators using the switches in critical manufacturing, transportation, energy, healthcare, financial services or government facilities should check exposure before the maintenance window becomes the control failure.
JUL 7
regulator
Hitachi Energy e-mesh EMS carries CVE-2026-42945 NGINX overflow
The fix list is simple, but the hotfix timing is not, which is how OT patch queues get ugly.
CISA republished Hitachi Energy’s advisory for CVE-2026-42945, an NGINX heap-based buffer overflow affecting e-mesh EMS 4.1.6, 4.4.2 and 4.7.0. The worldwide energy-sector footprint matters to DIB primes and state CISOs with OT dependencies. The immediate work is concrete: patch NGINX to v1.30.2 or later, keep ASLR active, check rewrite rules, and address Ubuntu 20.04 LTS exposure.
JUL 7
regulator
Digi PortServer TS and Digi One devices face auth bypass and XSS
Aging OT management interfaces leave operators fixing exposure at the network boundary while Digi points affected products toward replacement.
CISA issued ICSA-26-188-07 for CVE-2026-12352 and CVE-2026-12948 in Digi PortServer TS, Digi One SP, Digi One SP IA and Digi One IA devices before Firmware_2025. The advisory reaches worldwide deployments in critical manufacturing, communications, information technology and transportation systems. Digi tells PortServer TS users to enable HTTPS or disable the web server, and Digi One users to disable it or restrict access through firewall or VPN. For the stored cross-site scripting flaw, Digi says no firmware fix is coming and points operators to replacement hardware. CISA reports no known public exploitation.
JUL 7
regulator
CISA warns iDirect iQ-Series flaws expose satellite authentication credentials
The dangerous part is the identity layer: extracted DID and TPK values can support impersonation and reconnaissance.
CISA issued ICSA-26-183-01 for ST Engineering iDirect Evolution iQ, 3315 and 9-Series terminals running 4.5.2.1 or earlier. CVE-2026-38059 exposes API endpoints without authentication, letting attackers with network access retrieve DID and TPK values used for satellite network authentication. CVE-2026-38057 lets a malicious page trigger reboots through CSRF. Defense Industrial Base contractors, state CISOs and critical infrastructure operators should update to 4.5.2.2, restrict management interfaces and watch for anomalous API activity or unexpected reboots.
JUL 2
regulator
B&R patches XZ Utils flaw in eight controller lines
An open-source compression bug inside controllers turns dependency inventory into a production-line availability problem that cannot wait for audit season.
CISA republished ABB PSIRT SA26P009 for CVE-2025-31115, a high-severity race condition in XZ Utils' multithreaded decoder affecting B&R PPC3100, C50, C80, FT50, MT50, T30, T80 and T50 controllers. Critical manufacturing operators, including state, municipal and defense suppliers running those systems, should identify installed Terminal OS versions and apply B&R's fixes. B&R reported no exploitation information at original issuance, but the advisory leaves the public-disclosure timeline thin.
JUN 30
regulator
CISA flags CVSS 10 StoneFly Storage Concentrator flaws
For contractors, this is an exposure-management item: find SC and SCVM instances and move them to 8.0.4.29 or later.
CISA published an ICS advisory for StoneFly Storage Concentrator and Storage Concentrator Virtual Machine covering five vulnerabilities, including CVSS 10 unauthenticated command injection flaws in versions before 8.0.4.22 and 8.0.4.29. Defense industrial base, energy, financial services, healthcare, and information technology operators should patch to 8.0.4.29 or later. The credential issue spans database, licensing, replication, and third-party integration accounts stored in reversible encoded form.
JUN 30
regulator
CISA flags EcoStruxure DCE CVE-2026-8045 file-read flaw
Authenticated-only access keeps this below panic territory, but compromised accounts still turn monitoring software into a configuration-file scavenger.
CISA disclosed CVE-2026-8045, a CVSS 6.5 XML external entity flaw in Schneider Electric EcoStruxure IT Data Center Expert v9.1.1 and earlier. An attacker with a Data Center Expert user account can submit crafted XML payloads to SOAP service endpoints and read server-side file contents. Contractors running the software should move to v9.1.2 and treat delay as extra reconnaissance time in IT and OT environments.
JUN 30
regulator
CISA flags Mitsubishi MELSOFT Update Manager flaws
This is a patch-now manufacturing advisory, not a new architecture problem hiding inside the acronym stack.
CISA warned that Mitsubishi Electric MELSOFT Update Manager SW1DND-UDM-M versions 1.000A through 1.014Q contain four vulnerabilities that can enable arbitrary code execution, data tampering, or denial of service. Manufacturing operators, defense-industrial-base contractors, and MSPs supporting OT environments should move to version 1.015R or later, or isolate affected PCs and restrict access until they can. The open question is inventory, not intent: nobody knows how many sites still run the vulnerable branch.
JUN 30
regulator
Schneider Electric fixes EasyLogic T150, Saitel DP RTU credential flaws
The fix is firmware and a reboot, which is never a clerical task for remote operational technology gear.
The Cybersecurity and Infrastructure Security Agency published ICSA-26-181-04 for Schneider Electric EasyLogic T150, formerly Saitel DR, and Saitel DP remote terminal units. CVE-2026-9650 exposes stored credentials to unauthenticated access and carries a Common Vulnerability Scoring System v3.1 score of 7.5; CVE-2026-9651 can disclose password hashes to a privileged local attacker. Critical manufacturing and energy operators, including contractors and managed service providers, should move to EasyLogic T150 11.06.32 or Saitel DP 11.06.38. Both fixes require a reboot and Schneider says to contact Customer Care for the firmware.
JUN 30
regulator
CISA flags two critical Delta DVP12SE PLC flaws
For exposed control networks, this is the bill coming due for treating operational technology segmentation as a future project.
The Cybersecurity and Infrastructure Security Agency (CISA) issued a June 30 advisory for all Delta Electronics DVP12SE programmable logic controller (PLC) versions, disclosing CVE-2026-12819 and CVE-2026-12818. Successful exploitation could allow remote commands, control-logic changes and resource exhaustion over Modbus TCP without authentication. CISA lists Common Vulnerability Scoring System (CVSS) 3.1 scores of 9.8 and CVSS 4.0 scores of 9.3 for both flaws. Contractors, state chief information security officers and municipal IT teams running these PLCs in manufacturing or infrastructure systems get no patch yet, only Delta's IP filtering, password protection, isolation, firewall and virtual private network workarounds.
JUN 30
regulator
CISA flags critical Daktronics controller firmware flaws
Display controllers in hospitals and public facilities sit close enough to physical operations that default credentials become operational risk.
CISA published ICSA-26-176-04 for three Daktronics Controller Firmware vulnerabilities affecting VFC-DMP-5000, DMP-5000, and DMP-8000 versions below 8.117.x.x, 9.43.x.x, and 10.34.x.x worldwide. Commercial facilities, information technology, emergency services, and healthcare operators should update to 8.117.0.x, 9.43.0.x, or 10.34.0.x and replace default passwords. Two CVSS 4.0 scores hit 9.3 critical; CISA says exploitation could give an unauthenticated user complete root-level control.
JUN 25
regulator
CISA flags Yokogawa CVE-2026-11833 cleartext flaw
OT teams should treat this as network exposure and version validation work before scheduling Yokogawa patch windows.
CISA published ICSA-26-176-01 for CVE-2026-11833, a CVSS 3.1 7.5 cleartext transmission flaw in Yokogawa FAST/TOOLS R9.01 through R10.04 and Collaborative Information Server R1.01 through R1.04. Critical manufacturing, energy, and food and agriculture operators should check exposure and plan separate remediation tracks: FAST/TOOLS R10.04 SP4 and CI Server R1.05. CISA says it has no reports of public exploitation targeting the flaw.
JUN 25
regulator
CISA flags CVE-2026-12897 in Horner Automation Cscape
Operators get a vendor fix today, while exposure still depends on workstation hygiene and network segmentation.
CISA disclosed CVE-2026-12897, a high-severity out-of-bounds read in Horner Automation Cscape versions before 10.2 SP3. The flaw affects Critical Manufacturing environments, including defense-industrial-base operators using Cscape, and can let a local attacker disclose information and execute arbitrary code. Horner has released Cscape 10.2 SP3. CISA says it has no reports of public exploitation and the vulnerability is not remotely exploitable.
JUN 25
regulator
Schneider patches PowerLogic P7 command-execution and DoS flaws
Firmware is the easy part; live electrical operations still have to find the reboot window CISA does not provide.
CISA posted an ICS advisory for Schneider Electric PowerLogic P7 versions 0.2.003.001.000 and prior, with firmware V02.004.001 available and a reboot required. The high-severity issues, CVE-2026-9716 and CVE-2026-9717, cover HMI/configuration denial of service and privileged authenticated command execution; CISA also lists CVE-2026-9718, a medium denial-of-service flaw. Energy, critical manufacturing and commercial facilities get concrete mitigations, but no staged reboot guidance.
JUN 25
trade-press
Cisco SD-WAN zero-day gives attackers root access
The useful part is not the zero-day label; it is that SD-WAN managers sit where normal endpoint telemetry barely reaches.
Mandiant told CyberScoop that attackers exploited Cisco Catalyst SD-WAN Manager flaws, including CVE-2026-20245, to compromise an unnamed communications service provider and create a rogue root-level account. Cisco has patched the flaw. Federal Civilian Executive Branch agencies already face CISA Emergency Directive 26-03 duties to inventory, update and assess Cisco SD-WAN systems; contractors are outside the directive, but not outside the blast radius.
JUN 24
regulator
CISA flags 48 Siemens SIPROTEC 5 relay variants
Authenticated access lowers the internet-noise risk, but it does not help operators whose protection relays still lack clean fixes.
CISA published a Siemens advisory for CVE-2025-40808, an authenticated DIGSI 5 arbitrary file-upload flaw affecting 48 SIPROTEC 5 protection relay models across CP050, CP100, CP150, CP200 and CP300 series. DIB, municipal and utility contractors should move covered devices to V9.90 or later, with 7ST85 and 7ST86 on CP300 requiring V10.00 or later. Siemens says some fixes are still being prepared, and the patch map is doing too much of the risk-management work.
JUN 23
regulator
CISA flags B&R Linux escalation flaws with public exploits
A 7.8 local flaw becomes an executive problem when patch timing depends on vendor availability and site access discipline.
CISA published ICSA-26-174-06 for Linux kernel privilege-escalation vulnerabilities in B&R Industrial Automation Linux for B&R 12 and earlier, APROL before APROL-AutoYaST-DVD-V4.4-010.10.260602, and all X20EDS410 systems. Public proof-of-concept exploits exist, but B&R reported no evidence of active exploitation against its products. Defense-industrial-base contractors running those systems need to validate local access controls now, because the advisory leaves much of the patch schedule at “upon availability.”
JUN 23
regulator
CISA flags ABB Freelance Security Lock bypass
The 6.6 score undersells the problem: the affected control-system lock is the thing meant to keep operators out of Windows.
CISA issued ICSA-26-174-05 for CVE-2025-7064, an authentication bypass in ABB Freelance Security Lock across all versions installed with Freelance 2013 through 2024. The flaw lets an attacker use undocumented or special keyboard combinations to reach underlying OS functions, depending on configuration and permissions. Contractors, MSPs and defense-industrial-base operators supporting critical manufacturing should treat the local-only rating as a control-layer exposure, not a paperwork-medium vulnerability.
JUN 23
regulator
Siemens leaves older WinCC Certificate Manager versions unpatched
The operational problem is the legacy estate: V21 has an update path, while V16 through V20 get mitigations and risk acceptance.
CISA republished Siemens ProductCERT SSA-063511 for CVE-2026-24349, a CVSS 7.1 cleartext-storage flaw in WinCC Certificate Manager that can let a local attacker extract cryptographic key material. SIMATIC WinCC Unified PC Runtime V16 through V20 are affected with no fix planned; V21 before 21.0.2 should move to V21 Update 2 or later. Critical infrastructure operators, defense-industrial-base contractors and MSPs supporting OT sites now have a familiar choice: restrict access around old systems or fund a version migration.
JUN 23