Topic · vuln-advisory

Vulnerability advisory

Vendor-agnostic vulnerability and CVE catalog news where the practitioner question is "do I run this product?" not "did the rules change?" Tag this ALONE (no policy/enforcement co-tags). Routes to a separate watch rail.

RSS feed ↗

regulator
Weintek patches cMT3092X HMI privilege-escalation flaws
The fix ships as a standalone patch rather than a firmware update, and engineers must request it directly from Weintek support or distributors.
CISA published an ICS advisory Thursday for four vulnerabilities in the Weintek cMT3092X HMI, deployed in critical manufacturing worldwide. Two flaws (CVE-2026-60134, CVE-2026-61892) carry CVSS 8.8 scores and allow a low-privileged user to escalate to full system control via cookie or token manipulation. A third confirms plaintext password storage (CVE-2026-61886), and a fourth permits modification of read-only data (CVE-2026-60135). The fix, EasyWeb 2.3.17-typeb, bundled in patch cmt_typeB_20260316_007.patch, won't ship as a standard firmware release and must be requested from Weintek support or distributors.
THU
regulator
Rockwell ThinManager Path Traversal Hits Five Sectors
The authentication requirement limits the immediate blast radius, but five critical infrastructure sectors face a privilege-escalation path that demands patching, not postponement.
CISA published an advisory for CVE-2026-11917, a path traversal in Rockwell Automation ThinManager (versions 13.0 through 14.0) that lets an authenticated attacker write arbitrary files to restricted system directories. The CVSS 8.1 flaw affects five critical infrastructure sectors (Chemical, Critical Manufacturing, Energy, Food and Agriculture, and Water and Wastewater) with deployments worldwide. Rockwell has patched all four affected version branches. The authentication requirement buys operators time; this isn't an unauthenticated remote takeover. But the privilege-escalation chain and the deployment footprint across global critical infrastructure mean patching windows should close fast.
THU
regulator
MZ Automation libIEC61850 Hit by Four Critical ICS Flaws
A heap-based buffer overflow in the MMS stack can achieve RCE when ASLR is off, a configuration that's common in embedded substation gear.
CISA issued an advisory covering four vulnerabilities in MZ Automation libIEC61850 versions 1.0.0 through 1.6.1. The library is deployed worldwide across critical manufacturing, energy, and transportation systems. The most severe (CVE-2026-49035, a heap-based buffer overflow in MMS Initiate request handling) carries a CVSS 4.0 score of 9.2 and has demonstrated remote code execution when ASLR is disabled. Two additional flaws allow denial-of-service via crafted GOOSE frames or malformed WriteRequests, and a stack-based buffer overflow in ReadRequest handling rounds out the set. MZ Automation recommends updating to the latest build but hasn't published a patch timeline or backward-compatibility guidance. All four were reported by a single researcher, Abhinav Agarwal.
THU
regulator
MZ Automation lib60870 Flaw Allows Unauthenticated Remote ICS DoS
The out-of-bounds read (CVE-2026-16002, CVSS 8.2) requires no authentication or user interaction; update to version 2.4.1 closes it.
CISA published ICS advisory ICSA-26-204-07 for CVE-2026-16002, an out-of-bounds read (CWE-125) in MZ Automation lib60870 versions 2.4.0 and earlier. The vulnerability carries a CVSS 8.2 score and allows unauthenticated remote attackers to crash the IEC 60870-5-104 parsing process, denying service. Affected sectors include chemical, energy, and water. The fix is a version bump to 2.4.1. No exploitation in the wild has been reported to CISA.
THU
regulator
Panduit IntraVUE Plaintext Passwords Enable OT Segmentation Bypass
A management tool trusted to see everything on the OT network stores passwords in plaintext and hands attackers a CVSS 10.0 path across the IT/OT boundary.
CISA's advisory covers five vulnerabilities in Panduit IntraVUE versions 3.2.1a14 and earlier. The critical is CVE-2026-42933 (CVSS 10.0): an unauthenticated attacker can hijack an active proxy to bypass OT segmentation. CVE-2026-40430 (7.5) exposes plaintext credentials through the API. CVE-2026-28698 (8.6) exposes the underlying host filesystem. CVE-2026-50044 (6.8) enables pass-the-hash attacks on admin credentials via weak encryption. CVE-2026-44955 (5.3) allows unauthenticated asset discovery. Pronetiqs patches all five in version 3.2.1a16. No known exploitation reported. Researcher Phlebas of Lumintel reported the vulnerabilities to CISA.
THU
regulator
Johnson Controls Patches XAAP Android Cleartext Storage Flaw
The vulnerability requires local access or device compromise, not network attack; version 1.53 closes it.
CISA published an advisory for CVE-2026-34490, a cleartext storage vulnerability in Johnson Controls' XAAP Android application affecting versions below 1.53. The flaw stores application data locally without encryption, readable by anyone with physical access to the device or through a separate compromise, no network vector exists. Critical manufacturing sites running XAAP Android should update to version 1.53, which contains the fix. CVSS 3.1 base score is 3.3 (LOW).
THU
regulator
Johnson Controls C-CURE 9000 RCE Reaches Security Workstations
The deserialization bug reaches beyond the server to the desktops of security personnel, and into CISA's ICS advisory stream, not a routine product bulletin.
CISA published an advisory for three vulnerabilities in Johnson Controls' C-CURE 9000 access control and Victor video management systems. The most consequential, CVE-2026-21655 (CVSS 3.1: 8.8), lets an unauthenticated attacker on an adjacent network achieve arbitrary code execution on the application server and on connected client workstations used by physical security personnel. A separate SSRF flaw in Victor Web, CVE-2026-21653 (CVSS 3.1: 9.6), enables forged server-side requests that could allow lateral movement within the network. A third vulnerability, CVE-2026-34496, lets low-privilege users access unauthorized pages including user account details and audit logs. Johnson Controls has released patches: v3.20 or later for C-CURE 9000 and Victor application servers, and v7.0 or later for Victor Web.
THU
trade-press
Russian Zero-Click Zimbra Exploit Steals Government Emails
Zimbra's smaller government footprint means fewer eyes on the logs, and this is the third zero-click nation-state email campaign in 18 months.
U.S. cyber agencies warned Thursday that Russian state-backed group Laundry Bear is exploiting a zero-click vulnerability in Zimbra Collaboration Suite that requires only that a victim open or preview a malicious email, no link click, no download. Active since July 2025, the campaign has hit more than 10 organizations across the defense industrial base, federal and local government, law enforcement, and other sectors. The exploit steals email archives up to 90 days, passwords, and two-factor authentication tokens. Zimbra's smaller government footprint compared with Exchange means these intrusions are less likely to be detected quickly.
THU
regulator
CISA flags Tycon TPDIN-Monitor-WEB2 authentication bypass
Tycon's nonresponse leaves network isolation carrying risk that a vendor patch should be reducing for critical manufacturing operators.
The Cybersecurity and Infrastructure Security Agency (CISA) disclosed two flaws in Tycon Systems TPDIN-Monitor-WEB2 2.3.9: CVE-2026-61884, a CVSS v3.1 9.8 authentication bypass using empty login fields, and CVE-2026-55985, a cleartext credential storage flaw scored CVSS v3.1 4.3. The product is deployed worldwide in critical manufacturing. Defense industrial base contractors and Cybersecurity Maturity Model Certification Third-Party Assessment Organizations (C3PAOs) should treat the web interface as immediate operational technology risk, because Tycon did not respond to CISA coordination and no vendor fix is listed.
TUE
regulator
Siemens ships CADRA V2511 while Foxit fixes remain open
The patch closes old library debt, but CISA's mitigation-only rows keep operators from treating V2511 as complete.
Siemens released CADRA V2511, and CISA lists it as the vendor fix for CADRA versions before V2511 affected by zlib CVEs including CVE-2016-9841, CVE-2022-37434 and CVE-2023-45853, each scored 9.8. Primes, subs and contractors using CADRA in chemical, commercial facilities, communications or energy environments should also keep the Foxit-related V8 items open, because CISA lists mitigation only for CVE-2025-10585 and CVE-2025-13223.
TUE
regulator
CISA flags Rockwell 1718/1719 Ex I/O DoS flaw
For plants running version 3.011, the practical work is narrow: schedule firmware 3.012 before a network storm becomes downtime.
CISA published ICSA-26-202-08 for CVE-2026-9140, a Rockwell Automation 1718-AENTR/1719-AENTR Ex I/O denial-of-service flaw affecting version 3.011. Rockwell recommends upgrading to version 3.012 or later. Critical manufacturing operators, including defense-industrial-base primes and subs with these devices, should treat this as a remote, low-complexity availability issue. CISA says it has no reports of known public exploitation.
TUE
regulator
CISA flags Siemens IAM Client privilege-escalation flaw
A medium CVSS score still matters when the vulnerable client sits inside engineering and simulation workflows defense suppliers already trust.
The Cybersecurity and Infrastructure Security Agency republished Siemens ProductCERT SSA-288252 for CVE-2025-40945, a CVSS 6.7 untrusted search path flaw in Siemens IAM Client. The advisory lists 16 affected Siemens products, including COMOS, Designcenter NX, Simcenter, Solid Edge, Teamcenter Visualization and Tecnomatix. Primes, subs and defense-industrial-base operators using those tools in industrial environments should plan coordinated updates, especially where Siemens lists fixes for some products and further fix versions or countermeasures for others.
TUE
regulator
CISA flags Rockwell 1734 POINT I/O DoS flaw
The operational risk is boring but real: a crafted CIP message can turn a standard I/O module into a production stop.
CISA disclosed CVE-2026-10573, a CVSS 7.5 denial-of-service flaw in Rockwell Automation 1734 POINT I/O version 3.023, deployed worldwide in critical manufacturing. Contractors, primes and subs running the module face a remote crafted-CIP-message path to a faulted state; recovery requires manually restarting affected modules. Rockwell recommends migration to 5034-OB8, while CISA’s notice gives no availability date for that replacement.
TUE
regulator
CISA flags Rockwell Studio 5000 path traversal, code execution flaws
Treat ACD project files like executable content until affected engineering workstations move to the corrected Studio 5000 releases.
The Cybersecurity and Infrastructure Security Agency published ICSA-26-202-10 for three Rockwell Automation Studio 5000 Logix Designer vulnerabilities: CVE-2026-9108 path traversal in ACD project-file handling, CVE-2026-9127 incorrect authorization, and CVE-2026-9128 unquoted search path. Affected versions span V32.00 through V36.00. Defense Industrial Base contractors, managed service providers and state chief information security officers supporting critical manufacturing should patch engineering workstations or apply Rockwell's mitigations.
TUE
regulator
CISA flags PAN-OS flaws in Siemens RUGGEDCOM APE1808
Firewall software vulnerabilities become industrial-appliance risk once they ride inside OT network gear.
CISA republished a Siemens ProductCERT advisory for all Siemens RUGGEDCOM APE1808 devices running Palo Alto Networks Virtual NGFW, covering CVE-2026-0266, CVE-2026-0272 and CVE-2026-0273. The flaws include stored cross-site scripting, privilege escalation and OS command injection, with the command-injection bug rated CVSS 7.2. Contractors, defense-industrial-base operators and municipal teams using the appliance should restrict management access and contact support for patch information.
TUE
regulator
CISA flags Siemens SmartPlug flaws rated CVSS 9.8
This is the familiar OT appliance problem: inherited open-source defects become plant-floor exposure on someone else’s patch calendar.
CISA warned that Siemens SIDIS Secured SmartPlug versions before V7.26.0310 carry multiple vulnerabilities in OpenSSL, OpenSSH, hostapd, busybox and other packages, including a CVSS 9.8 issue. Siemens released V7.26.0310 and recommends updating. Contractors, MSPs and ISVs supporting critical manufacturing deployments should treat this as an OT maintenance item, not a paperwork entry.
TUE
regulator
CISA flags JWT forgery in Rockwell FTSP 6.60
Accepting a JSON Web Token algorithm value of `none` is the authentication failure industrial identity plumbing should never ship.
CISA issued ICSA-26-202-07 for CVE-2026-10714, a weak-authentication flaw in Rockwell Automation FactoryTalk Services Platform (FTSP) 6.60. A low-privilege authenticated user can set the JSON Web Token algorithm to `none`, forge tokens, impersonate authorized users, change configurations, and grant permissions to other FTSP-protected systems. Defense suppliers, contractors, and managed service providers running FTSP should apply RAID 1158263 or the February 2026 Patch Roll-up. CISA lists the CVSS 3.1 score as 7.8 High and reports no known public exploitation.
TUE
regulator
CISA flags CVSS 10 Siemens Opcenter X JWT bypass
For OT teams, the practical trigger is network reachability: credentials and user interaction are absent from the attack path.
CISA republished Siemens ProductCERT SSA-096828 for Siemens Opcenter X versions before V2604, assigning CVSS v3.1 10 to CVE-2026-56451. The JWT validation flaw lets an unauthenticated remote attacker forge tokens and impersonate any user, including administrators. Critical manufacturing operators worldwide, including defense industrial base suppliers, municipal IT shops and contractors using Opcenter X, should move to V2604 or isolate affected instances. The advisory gives only general network-exposure guidance, so this is a patch-or-isolate clock.
TUE
regulator
CISA adds four KEV flaws under BOD 26-04
The directive turns KEV triage into an agency obligation, which contractors can no longer treat as advisory hygiene.
CISA added CVE-2021-27137 in DD-WRT, CVE-2026-0770 in Langflow, and two WordPress Core flaws, CVE-2026-63030 and CVE-2026-60137, to the Known Exploited Vulnerabilities Catalog based on active exploitation. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total post-exploitation control. Government contractors, primes, subcontractors and C3PAOs now have a cleaner compliance baseline, even though CISA’s alert does not spell out the patch timeline or verification mechanics for these four entries.
TUE
standards
Microsoft patches 40-plus products, including SQL and LSASS
The hard part is not deciding whether to patch, but sequencing domain, database, endpoint and customer environments without leaving crown jewels exposed.
Microsoft issued September 9 patches for more than 40 products, with MS-ISAC warning that the most severe vulnerabilities could allow remote code execution. Contractors, primes, subs and managed service providers should prioritize SQL Server, Windows PowerShell, Office, LSASS and SMBv3 exposures. MS-ISAC says it has no reports of exploitation in the wild, but the advisory does not specify CVSS scores, exploit timing or Windows Server 2019 and 2022 patch coverage.
MON
trade-press
AI vulnerability hunting exposes the federal patch bottleneck
More bug discovery helps only if agencies can close findings before adversaries turn the backlog into inventory.
Federal News Network commentary from RunSafe Security’s Doug Britton argues that artificial intelligence will accelerate vulnerability discovery faster than organizations can remediate. The affected audience is federal cyber teams and contractors already triaging common vulnerabilities and exposures, especially where patching takes weeks or months. The useful warning is narrower than the headline: faster scanning does not create patch capacity, and known-but-unfixed flaws are still breach material.
JUL 17
regulator
CISA adds three Fortinet and SharePoint CVEs to KEV
BOD 26-04 turns these listings into federal patch priority, while the alert itself does not state a standalone remediation deadline.
CISA added CVE-2026-25089 and CVE-2026-39808, both Fortinet FortiSandbox OS command injection flaws, and CVE-2026-58644, a Microsoft SharePoint deserialization flaw, to the Known Exploited Vulnerabilities (KEV) Catalog. Binding Operational Directive (BOD) 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control after exploitation. Contractors and managed service providers inherit the urgency when they operate those federal environments.
JUL 16
regulator
CISA flags SALTO ProAccess Space partition bypass
Logical tenancy is not a security boundary when one valid operator account can cross every door group it was meant to contain.
CISA published ICSA-26-197-07 for CVE-2026-11889 in SALTO ProAccess Space versions before 6.13. Installations using the tenancy or logical partition feature allow an authenticated operator to bypass authorization and access spaces outside the assigned partition. Contractors, C3PAOs and municipal IT teams using SALTO for multi-tenant facilities should patch to 6.13 and reassess whether partitioning is carrying more trust than it deserves.
JUL 16
regulator
CISA flags AutomationDirect Productivity Suite kernel flaws
Local-only does not mean low-risk when the target is the engineering workstation that programs manufacturing PLCs.
CISA published ICSA-26-197-04 for six AutomationDirect Productivity Suite vulnerabilities affecting versions through v4.6.2.2 in critical manufacturing deployments worldwide. AutomationDirect recommends updating to v4.7.0.47 or later. The flaws require local or physical access, but they reach kernel-level failure modes: privilege escalation, memory corruption, information disclosure and denial of service.
JUL 16
regulator
Rockwell Arena V17.00.01 fixes four out-of-bounds write CVEs
The recurring CWE-787 pattern matters more than the CVE count: inventory Arena installs before malicious files become the delivery mechanism.
CISA published ICSA-26-197-01 for CVE-2026-8085, CVE-2026-8312, CVE-2026-8313 and CVE-2026-8314, four high-severity CWE-787 out-of-bounds write flaws in Rockwell Automation Arena V17.00.00 and earlier. Rockwell recommends updating to V17.00.01. Defense-industrial-base contractors and independent software vendors using Arena in critical manufacturing workflows should treat malicious files as the exploit path; CISA reports no known public exploitation.
JUL 16
regulator
CISA flags three Rockwell Automation controller denial-of-service flaws
For plants running Logix hardware, the operational risk is availability: invalid project or file data can trigger a major nonrecoverable fault.
CISA published ICSA-26-197-06 for CVE-2025-12011, CVE-2025-12012 and CVE-2025-11698, three Rockwell Automation CompactLogix, ControlLogix, GuardLogix and Compact GuardLogix buffer-overflow vulnerabilities. The advisory assigns CVSS v3.1 8.6 and covers critical manufacturing deployments worldwide. Defense primes, subs and other contractors running affected Rockwell controllers should check firmware levels, because exploitation can involve invalid project or file data and push a controller into a major nonrecoverable fault.
JUL 16
regulator
CISA flags Rockwell 1756-EN2, EN3, ENBT DoS flaw
The uncomfortable part is not the CVSS score; it is the discontinued ENBT sitting in plants with no vendor fix.
CISA published ICSA-26-197-02 for CVE-2026-9653, a network-accessible denial-of-service flaw in Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT modules. EN2 and EN3 operators should update to V12.002 or segment control networks; ENBT V6.006 is discontinued and has no fix. CISA says no known public exploitation has been reported.
JUL 16
regulator
CISA flags FactoryTalk DataMosaix XSS, Rockwell urges 8.03
The v3 medium score is the wrong comfort blanket for stored JavaScript that can steal credentials in an ICS-adjacent platform.
CISA issued ICSA-26-197-09 for CVE-2026-9292, a stored cross-site scripting flaw in Rockwell Automation FactoryTalk DataMosaix Private Cloud 8.02 and earlier. Authenticated high-privilege attackers can plant scripts in Workflows configuration, with potential account takeover, credential theft, or malicious redirection. Rockwell recommends upgrading to 8.03 or later; CISA says it has no known public exploitation reports.
JUL 16
regulator
Siemens patches SICAM 8 firmware signature bypass
The hard case is CVE-2026-54799: malicious firmware can outlast the maintenance window that critical infrastructure patching usually gets.
The Cybersecurity and Infrastructure Security Agency warned that Siemens SICAM 8 CPCI85 and SICORE versions before V26.20/V26.20.0 carry four flaws: HTTP-exposed debug code, firmware signature bypass, insecure defaults and weak web API credential checks. Siemens says to update affected CP-8031/CP-8050, CP-8010/CP-8012, SICAM EGS and S8000 packages. Energy, critical manufacturing and defense industrial base operators, plus Cybersecurity Maturity Model Certification Third-Party Assessment Organizations, should focus on CVE-2026-54799 because malicious firmware creates persistence in environments that usually patch slowly.
JUL 16
regulator
CISA flags CVE-2026-12659 in Rockwell Flex 5000 Adapter
The practical risk is recovery: a successful attack means power-cycling the module and associated I/O after crafted Common Industrial Protocol traffic.
CISA issued ICSA-26-197-08 for Rockwell Automation Flex 5000 Adapter 6.011, where CVE-2026-12659 lets crafted Common Industrial Protocol (CIP) packets trigger a denial-of-service condition. Rockwell rates the double-free flaw CVSS 3.1 7.5 and recommends upgrading to 6.012; CISA reported no known public exploitation. Defense-industrial-base primes and suppliers running the adapter in critical manufacturing should plan the firmware move, because recovery requires a power cycle of the module and associated I/O.
JUL 16
regulator
CISA flags NASA cFS HS denial-of-service flaw
Availability is the issue here: exposed cFS HS deployments can be crashed without credentials or user interaction.
CISA published CVE-2026-15352 for NASA Core Flight System Health & Safety application versions before v7.0.1. The NULL pointer dereference can crash the HS application during Housekeeping Telemetry processing, causing denial of service. Organizations running cFS HS modules, including government and defense-industrial-base environments with transportation-system exposure, should update to v7.0.1. CISA reports no known public exploitation.
JUL 16
trade-press
CISA adds exploited SonicWall SMA1000 zero-days to KEV
SMA1000 operators need to upgrade, check SonicWall’s indicators of compromise, and treat suspicious activity as a live intrusion.
SonicWall disclosed CVE-2026-15409 and CVE-2026-15410 for SMA1000 appliances Tuesday, and CISA added both to the Known Exploited Vulnerabilities catalog the same day. Rapid7 told CyberScoop exploitation began June 22 and likely aimed at ransomware. SonicWall says fewer than 5,000 SMA1000 units sit within its roughly one million monitored sensors, but also warned customers that patching alone is insufficient.
JUL 15
regulator
CISA adds CVE-2023-4346, CVE-2026-46817 to KEV catalog
BOD 26-04 makes high-risk KEV entries binding work on exposed federal assets, and contractors that run them inherit urgency.
CISA added CVE-2023-4346 in KNX Protocol and CVE-2026-46817 in Oracle E-Business Suite to the Known Exploited Vulnerabilities (KEV) Catalog after evidence of active exploitation. Federal Civilian Executive Branch agencies must prioritize high-risk KEV flaws on publicly exposed assets that grant total control after exploitation under Binding Operational Directive (BOD) 26-04. Contractors and managed service providers that administer those systems inherit the urgency, but CISA’s alert does not list specific due dates for these two CVEs.
JUL 15
regulator
CISA and NSA publish CVD guidance for software vendors
This does not impose a new duty, but it gives buyers a federal yardstick for vendor disclosure hygiene.
CISA, the National Security Agency and international partners released coordinated vulnerability disclosure best practices for software manufacturers and online service providers. The guidance covers vulnerability disclosure policies, triage and remediation workflows, Common Vulnerabilities and Exposures identifier assignment, and use of intermediaries such as CISA or national computer security incident response teams. For primes and ISVs, nothing changes Monday unless a customer makes it contractual.
JUL 15
standards
Google fixes three Chrome code-execution vulnerabilities
No active exploitation is reported, but workstation impact turns on a familiar control: whether browser users have admin rights.
Google released Chrome 149.0.7827.200/201 for Windows and Mac and 149.0.7827.200 for Linux to fix CVE-2026-13281, CVE-2026-13282 and CVE-2026-13283. MS-ISAC rates the risk medium for government and business entities, with no known exploitation. State, municipal, contractor and MSP teams should apply updates after testing; admin-rights browsing can turn user-context code execution into full system control.
JUL 14
standards
CIS flags CVE-2025-48703 pre-auth RCE in CWP
A free hosting control panel becomes a server takeover path when the admin surface stays internet-facing and unpatched.
CIS MS-ISAC advisory 2025-100 warns that CWP, also known as Control Web Panel or CentOS Web Panel, before 0.9.8.1205 allows unauthenticated remote code execution through shell metacharacters in filemanager changePerm requests. Primes, subs and municipal IT shops running CWP should patch after testing. Public proof-of-concept code means the safe assumption is scanning, not theory.
JUL 14
regulator
CISA adds four SonicWall, AD FS, SharePoint CVEs to KEV
CISA's catalog entry matters because BOD 26-04 turns edge-device patching into a federal compliance clock.
CISA added CVE-2026-15409 and CVE-2026-15410 in SonicWall SMA1000 appliances, CVE-2026-56155 in Microsoft Active Directory Federation Services, and CVE-2026-56164 in Microsoft SharePoint Server to the Known Exploited Vulnerabilities Catalog. Federal Civilian Executive Branch agencies must prioritize rapid remediation under Binding Operational Directive 26-04 for KEV flaws on publicly exposed assets that grant total control after exploitation. Contractors, vendors, and managed service providers supporting those environments inherit the urgency, even where the CISA alert leaves the exact agency deadline unstated.
JUL 14
regulator
CISA links three SharePoint CVEs to active exploitation
This is now a coordinated SharePoint server problem, not three vulnerability tickets waiting for the next maintenance window.
CISA says CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 are being actively exploited against all supported on-premises SharePoint Server versions, enabling remote code execution, IIS machine-key theft, persistence, and malware deployment. Contractors, managed service providers, municipalities, and government operators running SharePoint Server 2016, 2019, or Subscription Edition should patch, enable AMSI in Full Mode where feasible, hunt for compromise before rotating keys, and treat positive detections as incident-response triggers.
JUL 14
regulator
ABB patches CVE-2025-13162 in Advant Master Online Builder
A 4.4 CVSS score is the wrong comfort metric when plant-floor local access already means the perimeter failed.
CISA relayed ABB’s patch guidance for CVE-2025-13162, a CVSS 4.4 uncontrolled DLL search-path flaw in Advant Master Online Builder that can permit local code execution. The remediation path covers Control Builder A 1.4/4 and earlier and 800xA for Advant Master 6.0.3-1, 6.1.1-1 through 6.1.1-4, and 6.2.0-1. Primes, contractors and MSPs supporting critical manufacturing sites should update to Control Builder A 1.4/5, 800xA 6.1.1-5, or 6.2.0-3. ABB also withdrew builds after reintroducing or mis-presenting the vulnerable Online Builder.
JUL 14
regulator
ABB patches CVE-2026-31431 in Edgenius industrial gateways
The local-only exploit condition matters less when the affected edge box hosts container workloads inside OT infrastructure.
ABB released Edgenius 3.2.4.1 to fix CVE-2026-31431, a CVSS 7.8 Linux kernel privilege-escalation flaw affecting versions 3.2.0.0 through 3.2.4.0 on bE100, E3100C, and vE1000 systems. Contractors and MSPs supporting critical-manufacturing OT environments should patch exposed Edgenius nodes. ABB says exploitation requires local access or a compromised container workload, which is exactly the detail that keeps this from being a simple perimeter problem.
JUL 14
regulator
CISA flags four ABB T-MAC Plus flaws
Authenticated users on affected industrial networks can reach file disclosure, privilege escalation and authorization-bypass paths before the 4.0-25 fix lands.
CISA published an advisory for four vulnerabilities, CVE-2025-14771 through CVE-2025-14774, in ABB T-MAC Plus 4.0-24. ABB says version 4.0-25 corrects the issues. The highest score is CVSS 9.9, with impacts including sensitive file exfiltration, administrative operations by low-privilege users, stored XSS and a Card Reader service denial of service.
JUL 14
regulator
CISA flags CVSS 10 Rockwell EtherNet/IP adapter takeover flaw
This is the bad OT advisory: network access, no credentials, no user interaction, and commands that can change I/O states.
CISA republished Rockwell Automation advisory SD1785 for CVE-2026-10577, a CVSS 10.0 flaw in 1715-AENTR EtherNet/IP Adapter versions 3.003 and earlier. The exposed debug port allows unauthenticated remote access to intrusive CLI commands, including file deletion, task termination, memory modification, and I/O state changes. Energy, water, critical manufacturing, and contractors or MSPs supporting those environments should upgrade to version 3.011 or reduce network exposure immediately. CISA says it has no reports of public exploitation.
JUL 14
regulator
CISA adds Cisco IOS CVE-2008-4128 to KEV
Federal agencies get a binding remediation priority, but CISA’s alert leaves the exact BOD 26-04 deadline unstated.
CISA added CVE-2008-4128, a Cisco IOS cross-site request forgery vulnerability, to the Known Exploited Vulnerabilities Catalog after evidence of active exploitation. Federal Civilian Executive Branch agencies must prioritize remediation under Binding Operational Directive 26-04 for qualifying publicly exposed assets. State CISOs and contractors servicing federal networks should treat the listing as a practical audit and remediation trigger.
JUL 13
regulator
CISA flags six Schneider PowerChute Serial Shutdown flaws
The fix is straightforward: inventory PowerChute Serial Shutdown 1.4 and earlier, then move Windows and Linux installs to 1.5.
CISA issued an ICS advisory for six vulnerabilities in Schneider Electric PowerChute Serial Shutdown 1.4 and earlier, with a CVSS 3.1 score of 6.1. The flaws include path traversal, credential-reset exposure, denial-of-service conditions and log tampering risks. Contractors, MSPs, ISVs and defense-industrial-base operators using the product in critical infrastructure should upgrade to version 1.5, since the advisory does not identify an interim mitigation that closes every vector.
JUL 9
regulator
Schneider Easergy MiCOM Px40 relays expose device data through SNMP
CVSS 5.3 understates the operational problem when the target is a protection relay deployed across voltage classes.
CISA published ICSA-26-190-03 for CVE-2026-4832, a CVSS 5.3 hard-coded credentials flaw in Schneider Electric Easergy MiCOM Px40 protection relays. Affected firmware spans Px40 models used in medium-, high- and extra-high-voltage systems worldwide, where unauthenticated attackers can interrogate the SNMP port for sensitive device information. Defense Industrial Base sites, municipal operators and contractors should upgrade firmware where SNMP is unnecessary, or isolate relays behind protected networks, firewalls and VPN-controlled remote access. The operational problem is fleet-level reconnaissance across voltage classes.
JUL 9
regulator
CISA flags CVE-2026-14480 in OpenPLC v3
End-of-life software turns a bad authenticated bug into an upgrade mandate, which is tidy advice until the plant cannot move that fast.
CISA published ICSA-26-190-01 for OpenPLC v3, warning that CVE-2026-14480 carries a CVSS 3.1 score of 9.9. The flaw lets an authenticated attacker write arbitrary files and potentially reach native code execution through OpenPLC’s normal compilation process. OpenPLC recommends upgrading to v4 because v3 is end-of-life; CISA says it has no reports of known public exploitation.
JUL 9
regulator
CISA puts Adobe ColdFusion CVE-2026-48282 in KEV
The operational burden is asset discovery first, patching second, because KEV only matters where exposed ColdFusion can hand over control.
CISA added CVE-2026-48282, an actively exploited Adobe ColdFusion path traversal vulnerability, to the Known Exploited Vulnerabilities Catalog. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies must prioritize remediation for KEV-listed CVEs on publicly exposed assets that can grant total control after exploitation. Contractors supporting federal systems should expect the same urgency through prime flowdowns. CISA’s alert does not supply exploit code, detection signatures, or a specific deadline.
JUL 7
regulator
CISA adds three CVEs to KEV Catalog
For exposed federal assets, the practical question is ownership speed, because CISA’s alert does not give the deadline.
CISA added CVE-2026-48908, CVE-2026-55255 and CVE-2026-56290 to the Known Exploited Vulnerabilities Catalog based on active exploitation evidence. Federal Civilian Executive Branch agencies must prioritize rapid remediation under Binding Operational Directive 26-04 for qualifying publicly exposed assets. Contractors, primes and assessors using affected JoomShaper, Langflow or Joomlack products should treat the listing as an immediate vulnerability-management input, though CISA’s alert does not state a specific deadline.
JUL 7
regulator
CISA flags Hydro-Québec EV charging backend flaws
The scary part is not EV chargers; it is unauthenticated OCPP plumbing sitting close enough to transportation infrastructure to matter.
CISA published ICSA-26-188-01 for three vulnerabilities in Hydro-Québec's Le Circuit Electrique charging station backend affecting versions before June 2026. CVE-2026-20744 carries a CVSS 3.1 score of 9.8 and could allow privilege escalation through improperly authenticated WebSocket connections; two denial-of-service flaws score 7.5. Operators, managed service providers and public-sector CISOs should verify whether remaining OCPP-dependent stations have Hydro-Québec's authentication mitigations or have disabled OCPP.
JUL 7
regulator
CISA flags Siemens Mendix Studio Pro code-injection CVE-2026-48192
Remediation is uneven: Siemens names two patched trains and gives the remaining affected versions no timetable.
CISA republished Siemens ProductCERT SSA-779310 for CVE-2026-48192, a CVSS 5.4 code-injection flaw triggered when Siemens Mendix Studio Pro processes malicious project files during build pipeline execution. The affected list spans Mendix Studio Pro 10.11 through 10.23, 10.24 before V10.24.21 and 11.0 through 11.11; fixes are listed only for V10.24.21 and V11.6.7. Contractors, independent software vendors and defense-industrial-base teams using Mendix for critical manufacturing or energy applications should treat project files as hostile build inputs.
JUL 7