PatchWatch OT: ICS security advisories for oil & gas control systems

Critical 9.8 ICSA-26-288-02 · Oct 15, 2026 · Guangzhou Juan IoT Technology Co., Ltd.

Guangzhou Juan IoT Technology EseeCloud

CISA reports 3 vulnerabilities in Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App, EseeCloud Firmware. Weakness types: Use of Hard-coded Credentials, Improperly Controlled Modification of Dynamically-Determined Object Attributes, Observable Response Discrepancy. Successful exploitation of these vulnerabilities co…

What to do: Act now: Guangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts. EseeCloud users are advised to contact Guangzhou Juan IoT Technology Co., Ltd. for support https://eseecloud.app/.

High 8.2 Oil & gas relevant ICSA-26-288-01 · Oct 15, 2026 · Eclipse Foundation

Eclipse Foundation Eclipse Milo

CISA reports 6 vulnerabilities in Eclipse Foundation Eclipse Milo. Weakness types: Incorrect Authorization, Missing Release of Memory after Effective Lifetime, Missing Authorization (+2 more). Successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and…

What to do: Prioritize: The Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5.

Medium 6.2 ICSA-26-286-02 · Oct 13, 2026 · Swann Communications

Swann Communications SWIFI-SE2KIC

CISA reports 3 vulnerabilities in Swann Communications SWIFI-SE2KIC firmware. Weakness type: Missing Authentication for Critical Function. Successful exploitation of these vulnerabilities could allow an attacker to view video information without authentication. Highest CVSS v3 score: 6.2 (Medium), not remotely exploita…

What to do: Plan: Keep device firmware updated when new releases become available.

High 8.8 Oil & gas relevant ICSA-26-286-01 · Oct 13, 2026 · Inductive Automation

Inductive Automation Ignition Software

CISA reports 1 vulnerability in Inductive Automation Ignition. Weakness type: Incorrect Authorization. Successful exploitation of this vulnerability could allow an authenticated low-level user to escalate their privileges to a higher level. Highest CVSS v3 score: 8.8 (High), exploitable over the network.

What to do: Prioritize: Inductive Automation released version 8.3.9 in August 2025 and version 8.1.55 in September 2026 to address this issue. Users are recommended to update to the newest version available.

High 8.8 ICSA-26-281-03 · Oct 8, 2026 · Satel

Satel Netco Design

CISA reports 4 vulnerabilities in Satel Netco Design. Weakness types: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Inefficient Regular Expression Complexity, Relative Path Traversal. Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary sc…

What to do: Prioritize: Satel advises users to update to Satel Netco Design v2.1.7.

Critical 9.8 ICSA-26-281-02 · Oct 8, 2026 · Grid Protection Alliance

Grid Protection Alliance openPDC and openHistorian

CISA reports 6 vulnerabilities in Grid Protection Alliance openPDC, openPDC (Docker image), openHistorian. Weakness types: Deserialization of Untrusted Data, Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF) (+2 more). Successful exploitation of these vulnerabilities could allow an attack…

What to do: Act now: Grid Protection Alliance has added additional validation into serialization logic in openPDC version 2.9.482 and later and openHistorian version 2.8.585 and later.

High 8.3 Oil & gas relevant ICSA-26-281-01 · Oct 8, 2026 · Red Lion Controls

Red Lion Controls N-Tron 700 Series - Update A

CISA reports 7 vulnerabilities in Red Lion Controls 700 Series. Weakness types: Use of Hard-coded Credentials, Insufficiently Protected Credentials, Storing Passwords in a Recoverable Format (+4 more). Successful exploitation of these vulnerabilities could allow a malicious user to access the device and gain administra…

What to do: Prioritize: Red Lion controls recommends users upgrade the N-Tron 700 Series to version 3.11.1 or greater.Red Lion controls recommends users configure or disable the SNMP communities.Red Lion controls recommends users disable access to the web GUI.

High 8.1 ICSA-26-280-01 · Oct 7, 2026 · CISA

CISA Malcolm

CISA reports 7 vulnerabilities in CISA Malcolm. Weakness types: Authentication Bypass by Spoofing, Incorrect Authorization, Server-Side Request Forgery (SSRF) (+3 more). Successful exploitation of these vulnerabilities could allow an unauthenticated attacker to gain access to the Arkime backend API under a forged ident…

What to do: Prioritize: This vulnerability was patched in Malcolm Version v26.08.0

Critical 9.8 Oil & gas relevant ICSA-26-279-06 · Oct 6, 2026 · Hitachi Energy

Hitachi Energy RTU500

CISA reports 6 vulnerabilities in Hitachi Energy RTU500 series CMU Firmware. Weakness types: Missing Authentication for Critical Function, Relative Path Traversal, Missing Authorization (+2 more). Hitachi Energy is publishing this cybersecurity advisory in response to the security findings reported by Dragos affecting …

What to do: Act now: Upgrade to version 12.7.8 or 13.9.1 or latest

Medium 6.5 Oil & gas relevant ICSA-26-279-05 · Oct 6, 2026 · Hitachi Energy

Hitachi Energy REB500

CISA reports 2 vulnerabilities in Hitachi Energy REB500. Weakness types: Uncontrolled Recursion, Allocation of Resources Without Limits or Throttling. Hitachi Energy is aware of open-source software vulnerabilities that affect REB500 product versions listed in this document. These vulnerabilities can be exploited to ca…

What to do: Plan: Update to version 8.3.4.0

High 8.8 Known exploited Oil & gas relevant ICSA-26-279-04 · Oct 6, 2026 · Hitachi Energy

Hitachi Energy SOI

CISA reports 1 vulnerability in Hitachi Energy SOI. Weakness type: Improper Control of Generation of Code ('Code Injection'). Hitachi Energy is aware of RCE (Remote Code Execution) vulnerability in Apache ActiveMQ component of SOI product versions listed in this document. These vulnerabilities can be exploited to carry…

What to do: Act now: Apply the patch SOI EP2, which upgrades the ActiveMQ version (JMS message broker) for the SOI Core to version 5.19.5. EP2 is a cumulative patch that covers previous EP1 patch.

High 8.1 ICSA-26-279-03 · Oct 6, 2026 · Hitachi Energy

Hitachi Energy Asset Suite

CISA reports 2 vulnerabilities in Hitachi Energy Asset Suite. Weakness type: Missing Authentication for Critical Function. Hitachi Energy is aware of unauthenticated servlet access vulnerabilities that affect Asset Suite product versions listed in this document. These vulnerabilities can be exploited to potentially cau…

What to do: Prioritize: Update or upgrade to Asset Suite 9.9.1 when available

Critical 9.8 ICSA-26-279-02 · Oct 6, 2026 · Savannah

Savannah lwIP SMTP client

CISA reports 1 vulnerability in Savannah lwIP SMTP client. Weakness type: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'). Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution. Highest CVSS v3 score: 9.8 (…

What to do: Act now: xchglabs reports that the vulnerability was fixed and released in the following patch: patch_125_smtp_txbuf.diff . This is available as available as git commit (614420f82c8729d070e01464c0dddb3c9525c772)

High 7.7 ICSA-26-279-01 · Oct 6, 2026 · Johnson Controls

Johnson Controls EasyIO FG

CISA reports 2 vulnerabilities in Johnson Controls EasyIO FG firmware. Weakness types: Use of Hard-coded Credentials, Improper Privilege Management. Successful exploitation of these vulnerabilities could allow an attacker to gain full unauthorized access to the device. Highest CVSS v3 score: 7.7 (High), not remotely ex…

What to do: Prioritize: Johnson Controls has determined that the EasyIO FG Series has reached End-of-Life (EOL) and End-of-Support (EOS) status. The product has not been manufactured or sold since prior to 2019, and the source code is no longer available.

High 7.7 ICSA-26-274-06 · Oct 1, 2026 · Meari

Meari IoT Cloud Platform OpenAPI Service

CISA reports 2 vulnerabilities in Meari IoT Cloud Platform OpenAPI Service. Weakness type: Missing Authorization. Successful exploitation of these vulnerabilities could allow attackers to manipulate device configurations, trigger unauthorized behaviors, and access sensitive information such as device credentials, owner…

What to do: Prioritize: No vendor fix is listed. Follow CISA's recommended practices: keep the devices off the internet, behind firewalls and isolated from business networks, and use secure remote access.

Medium 5.4 ICSA-26-274-05 · Oct 1, 2026 · Johnson Controls

Johnson Controls EasyIO Neo Series EC and CW Controllers

CISA reports 1 vulnerability in Johnson Controls EasyIO Neo Series EC Controllers, EasyIO Neo Series CW Controllers. Weakness type: Cleartext Transmission of Sensitive Information. Successful exploitation of this vulnerability could allow an attacker tointercept and read sensitive information, including credentials and…

What to do: Plan: Johnson Controls released fixed versions for EasyIO Neo Series EC and CW Controllers. Users should upgrade to the fixed version or later as soon as operationally feasible.

Low 3.5 ICSA-26-274-04 · Oct 1, 2026 · Johnson Controls

Johnson Controls EasyIO Neo Series EC and CW Controllers

CISA reports 1 vulnerability in Johnson Controls EasyIO Neo Series EC Controllers, EasyIO Neo Series CW Controllers. Weakness type: Exposure of Sensitive Information to an Unauthorized Actor. Successful exploitation of this vulnerability could allow an attacker to gain access to sensitive information that could be used…

What to do: Plan: Johnson Controls released fixed versions for EasyIO Neo Series EC and CW Controllers. Users should upgrade to the fixed version or later as soon as operationally feasible. The fix is available in EC firmware V3.3b64 and CW firmware V3.3b26.

Medium 6.4 Oil & gas relevant ICSA-26-274-03 · Oct 1, 2026 · ABB

ABB Protection and Control IED Manager PCM600

CISA reports 2 vulnerabilities in ABB Protection and Control IED Manager PCM600. Weakness types: Incorrect Permission Assignment for Critical Resource, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Successful exploitation of these vulnerabilities could allow an attacker to escalate pri…

What to do: Plan: Locate the ABBPCMSchedulerService corresponding to the installed PCM600 version.

Critical 9.4 ICSA-26-274-02 · Oct 1, 2026 · Monta

Monta monta.app

CISA reports 4 vulnerabilities in Monta monta.app. Weakness types: Missing Authentication for Critical Function, Improper Restriction of Excessive Authentication Attempts, Insufficient Session Expiration (+1 more). Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrati…

What to do: Act now: Monta states that they are actively working to increase adoption of authenticated connections across their network and to deprecate unauthenticated access on a rolling basis.

Critical 9.8 Known exploited ICSA-26-274-01 · Oct 1, 2026 · Armatura LLC

Armatura LLC Armatura One

CISA reports 5 vulnerabilities in Armatura LLC Armatura One, Armatura One (USA). Weakness types: Deserialization of Untrusted Data, Use of Hard-coded Cryptographic Key, Use of Hard-coded Credentials (+1 more). Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to the da…

What to do: Act now: Armatura LLC Armatura One vers:all/<4.7.2: Armatura LLC has released Armatura One V4.7.2, which resolves this issue. Users should upgrade from V4.7.1 or earlier to V4.7.2.

Critical 10.0 ICSA-26-272-07 · Sep 29, 2026 · Viidure

Viidure Dashcam Android Application

CISA reports 2 vulnerabilities in Viidure Dashcam Android Application. Weakness types: Incorrect Permission Assignment for Critical Resource, Use of Hard-coded Credentials. Successful exploitation of these vulnerabilities could allow attackers to access, modify, or delete sensitive user data and critical system files, …

What to do: Act now: No vendor fix is listed. Follow CISA's recommended practices: keep the devices off the internet, behind firewalls and isolated from business networks, and use secure remote access.

Critical 9.8 ICSA-26-272-06 · Sep 29, 2026 · MikroTik

MikroTik RouterOS

CISA reports 1 vulnerability in MikroTik RouterOS. Weakness type: Integer Underflow (Wrap or Wraparound). Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution or cause a denial of service. Highest CVSS v3 score: 9.8 (Critical), exploitable over the network.

What to do: Act now: MikroTik recommends users update RouterOS to version 7.24 or later. The upgrade can be downloaded from the MikroTik website.

Critical 9.8 ICSA-26-272-05 · Sep 29, 2026 · Anjvision

Anjvision YSSD-RTMP-H5

CISA reports 9 vulnerabilities in Anjvision YSSD-RTMP-H5 firmware. Weakness types: Initialization of a Resource with an Insecure Default, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Verification of Cryptographic Signature (+6 more). Successful exploitation of the…

High 7.4 ICSA-26-272-04 · Sep 29, 2026 · Baicells Technologies

Baicells Nova 430H

CISA reports 1 vulnerability in Baicells Technologies Nova 430H eNodeB (model pBS3101SH). Weakness type: Uncaught Exception. Successful exploitation of this vulnerability could allow an attacker to inject malformed messages which may lead to a denial-of-service condition. Highest CVSS v3 score: 7.4 (High), exploitable …

Critical 10.0 ICSA-26-272-03 · Sep 29, 2026 · VIVOTEK

VIVOTEK Camera Firmware

CISA reports 1 vulnerability in VIVOTEK V Series, C Series, S Series, Dome and 3 more. Weakness type: Improper Neutralization of Special Elements used in a Command ('Command Injection'). Successful exploitation of this vulnerability may allow attackers to achieve remote command execution on affected devices, potentiall…

What to do: Act now: VIVOTEK has addressed this issue and encourages users to download and install the latest firmware available.https://www.vivotek.com/en-US/resource/download-center/software-app-vadp-package

Critical 10.0 Oil & gas relevant ICSA-26-272-02 · Sep 29, 2026 · Toptech Systems

Toptech TMS7 and TopHAT

CISA reports 10 vulnerabilities in Toptech Systems TMS7, TopHAT. Weakness types: Files or Directories Accessible to External Parties, Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (+3 more). Successful exploitation of these vulnerab…

What to do: Act now: Toptech Systems sent a security advisory to their customers on July 20, 2026. The issues have been addressed in release 7.8. Users can get the latest release and more information on these issues, at the Toptech Systems security blog.

High 7.5 Oil & gas relevant ICSA-26-272-01 · Sep 29, 2026 · Lantronix

Lantronix G520 Series Cellular Gateway

CISA reports 2 vulnerabilities in Lantronix G520 Series. Weakness types: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Verification of Cryptographic Signature. Successful exploitation of these vulnerabilities could allow an attacker to replace software and execute arbitr…

What to do: Prioritize: Lantronix has addressed the reported issues with release version 2.6.0.7R6 which is available on their website.

Critical 9.4 ICSA-26-267-02 · Sep 24, 2026 · Eufy

Eufy Omni C20, Omni X10 Pro

CISA reports 3 vulnerabilities in Eufy Omni C20, Omni X10 Pro. Weakness types: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Use of Hard-coded Credentials, Improper Certificate Validation. Successful exploitation of these vulnerabilities could allow an attacker to run syste…

What to do: Act now: Eufy recommends users to upgrade to version 1.6.4 or later.

High 8.8 ICSA-26-267-01 · Sep 24, 2026 · Botslab

Botslab G980H Dashcams

CISA reports 14 vulnerabilities in Botslab G980H dash cam series. Weakness types: Incorrect Authorization, Insufficient Session Expiration, Generation of Predictable Numbers or Identifiers (+10 more). Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication controls, gain unauth…

What to do: Prioritize: Botslab has not responded to requests to work with CISA to mitigate this vulnerability. Users of affected versions of G980H Dashcams are invited to reach out to Botslab for more information: https://www.botslab.com/pages/about-botslab

Medium 6.1 ICSA-26-265-09 · Sep 22, 2026 · Autonomy Logic

OpenPLC Runtime v3

CISA reports 1 vulnerability in Autonomy Logic OpenPLC. Weakness type: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Successful exploitation of this vulnerability could allow an attacker to hijack session cookies and issue state-changing requests as an operator which would allow …

What to do: Plan: Autonomy Logic recommends users upgrade to OpenPLC v4 as OpenPLC v3 is end-of-life and is no longer receiving patches, bug fixes, or security updates.

Medium 6.5 ICSA-26-265-08 · Sep 22, 2026 · Siemens

Siemens WTV676 and WTV776

CISA reports 1 vulnerability in Siemens WTV676-HB6035 Web Interface, WTV776-HB6035 Web Interface. Weakness type: Improper Validation of Specified Type of Input. The products listed below contain a denial of service vulnerability that could allow an attacker to force the devices into protection mode under certain condit…

What to do: Plan: Update to V3.94 or later version

High 8.6 ICSA-26-265-07 · Sep 22, 2026 · Siemens

Siemens SIMOVE Fleetmanager and SIPLANT

CISA reports 1 vulnerability in Siemens SIMOVE Fleetmanager V3.1, SIMOVE Fleetmanager V3.2, SIMOVE Fleetmanager V3.3, SIMOVE Fleetmanager V4.0 and 4 more. Weakness type: Relative Path Traversal. SIMOVE Fleetmanager and SIPLANT contain a path traversal vulnerability that could allow an attacker to access files outside o…

What to do: Prioritize: Update to V3.1.13 or later version

Critical 9.1 Oil & gas relevant ICSA-26-265-06 · Sep 22, 2026 · Siemens

Siemens Industrial Edge Management

CISA reports 1 vulnerability in Siemens Industrial Edge Management Cloud, Industrial Edge Management Pro V1, Industrial Edge Management Pro V2, Industrial Edge Management Virtual. Weakness type: Weak Password Recovery Mechanism for Forgotten Password. Industrial Edge Management contains an authentication bypass vulnera…

What to do: Act now: Update to V1.15.20 or later version

High 8.2 ICSA-26-265-05 · Sep 22, 2026 · Siemens

Siemens Desigo CC family

CISA reports 1 vulnerability in Siemens Desigo CC family V6, Desigo CC family V7, Desigo CC family V8, Desigo CC family V9. Weakness type: Improper Control of Generation of Code ('Code Injection'). A Client Code Execution (CCE) vulnerability has been identified in Desigo CC, potentially allowing malicious actors to exe…

What to do: Prioritize: Evaluate authorization policy for Graphics application following Least Privilege principle, so only required users have access to the configuration. The vendor lists no fix for some issues, so lean on mitigations.

High 7.8 Known exploited Oil & gas relevant ICSA-26-265-04 · Sep 22, 2026 · Siemens

Siemens SIPLUS and SIMATIC Products

CISA reports 1 vulnerability in Siemens SIMATIC AX Runtime Core Linux Common Debian, SIMATIC AX Runtime Core Linux Common Debian arm64, SIMATIC AX Runtime Core Linux Platform Container Common Debian Development, SIMATIC AX Runtime Core Linux VMWare Development and 63 more. Weakness type: Incorrect Resource Transfer Bet…

What to do: Act now: Update to V21 Update 2 SR1 or later version

Critical 9.0 ICSA-26-265-03 · Sep 22, 2026 · Siemens

Siemens Siveillance Control

CISA reports 1 vulnerability in Siemens Siveillance Control Pro V3.0, Siveillance Control Pro V4.0, Siveillance Control V3.0, Siveillance Control V4.0. Weakness type: Unrestricted Upload of File with Dangerous Type. A vulnerability has been identified in the Open Interface Services (OIS) web module affecting Siveillanc…

What to do: Prioritize: Update to V3.0.12.2173 or later version

High 8.8 ICSA-26-265-02 · Sep 22, 2026 · lwIP

lwIP (Lightweight IP)

CISA reports 1 vulnerability in lwIP API. Weakness type: Double Free. Successful exploitation of this vulnerability could result in a system crash, a DoS, or memory corruption, which could lead to code execution on the victim system. Highest CVSS v3 score: 8.8 (High), exploitable from an adjacent network.

What to do: Prioritize: Users of lwIP are encouraged to update their version of lwIP using the repository found at https://cgit.git.savannah.gnu.org/cgit/lwip.git. The commit identifier that contains the fix is f873b6295933e4149a2132adf3e9a2d2a676a5ec.

Critical 9.8 ICSA-26-265-01 · Sep 22, 2026 · lwIP

lwIP TCP/IP Stack MQTT Client Application

CISA reports 1 vulnerability in lwIP MQTT Client Application. Weakness type: Out-of-bounds Write. Successful exploitation of this vulnerability could allow an attacker to gain full code execution on the device. Highest CVSS v3 score: 9.8 (Critical), exploitable over the network.

What to do: Act now: Users of lwIP are encouraged to update their version of lwIP using the repository found at https://savannah.nongnu.org/projects/lwip. The commit identifier that contains the fix is f89407ea711879c04d91c92b35d67be78bbaf0f1.

Medium 5.3 ICSA-26-260-07 · Sep 17, 2026 · Microsoft, Red Hat, SUSE, Schneider Electric

Schneider Electric PowerChute Serial Shutdown

CISA reports 1 vulnerability in Microsoft, Red Hat, SUSE, Schneider Electric PowerChute™ Serial Shutdown, Windows, Enterprise Linux. Weakness type: Improper Restriction of Excessive Authentication Attempts. Schneider Electric is aware of vulnerabilities in its PowerChute™ Serial Shutdown product. The PowerChute Serial …

What to do: Plan: Version v1.6 of PowerChute™ Serial Shutdown includes a fix for these vulnerabilities and is available for download here: • Windows: https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/ Reboot needed: Upon installation, the service…

High 7.8 Known exploited Oil & gas relevant ICSA-26-260-06 · Sep 17, 2026 · ABB

ABB Ability Edgenius

CISA reports 1 vulnerability in ABB Gateway - bE100, Gateway - E3100C, Server - vE1000. Weakness type: Incorrect Resource Transfer Between Spheres. ABB is aware of public reports of a vulnerability CVE‑2026‑31431 (Copy Fail) in the product versions listed as affected in the advisory. An update is available that resolve…

What to do: Act now: The problem is corrected in the following product versions: - Edgenius 3.2.4.1 ABB recommends that customers apply the update at earliest convenience.

Medium 6.4 ICSA-26-260-05 · Sep 17, 2026 · Schneider Electric

Schneider Electric NetBotz 5 750/755

CISA reports 2 vulnerabilities in Schneider Electric NetBotz 5 750, NetBotz 5 755. Weakness types: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), SQL Injection: Hibernate. Schneider Electric is aware of multiple vulnerabilities in its NetBotz 5 – 750/755 products.The NetBotz…

What to do: Plan: Version 5.6.0 of NetBotz 5 750/755 includes a fix for these vulnerabilities and is available for download here: https://www.se.com/us/en/product-range/61830-netbotz/#software-and-firmware Reboot needed: Upon install, the offer will…

High 7.5 Oil & gas relevant ICSA-26-260-04 · Sep 17, 2026 · Schneider Electric

Schneider Electric Modicon M340 Controller and Communication Modules

CISA reports 1 vulnerability in Schneider Electric Modicon M340 Firmware, Modicon M340 Controller, Ethernet / Serial RTU Module, M580 Global Data module and 3 more. Weakness type: Improper Input Validation. Schneider Electric is aware of a vulnerability in its Modicon M340 https://www.se.com/ww/en/product-range/1468-mo…

What to do: Prioritize: Version 3.60 of BMXNOE0100 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product/BMXNOE0100/networkmodule-modicon-m340-modbus-tcp-1-x-rj45-flash-memorycard/ Reboot is needed to…

Critical 9.9 Oil & gas relevant ICSA-26-260-03 · Sep 17, 2026 · Hitachi Energy

Hitachi Energy FACTS Control Platform (FCP)

CISA reports 5 vulnerabilities in Hitachi Energy FACTS Control Platform (FCP). Weakness types: Improper Neutralization of Special Elements in Data Query Logic, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Authentication Bypass by Capture-replay (+2 more). Hitachi Energy is aware of vu…

What to do: Act now: Follow general mitigation factors

High 8.8 Oil & gas relevant ICSA-26-260-02 · Sep 17, 2026 · Mitsubishi Electric

Mitsubishi Electric GX Works3 and Motion Control Settings

CISA reports 1 vulnerability in Mitsubishi Electric Mitsubishi Electric GX Works3, Mitsubishi Electric Motion Control Settings (Software packaged with GX Works3). Weakness type: Incorrect Implementation of Authentication Algorithm. Successful exploitation of this vulnerability could allow a local attacker to successful…

What to do: Prioritize: For customers using GX Works3, please download version 1.096A or later from the link…

High 7.5 ICSA-26-260-01 · Sep 17, 2026 · Bransys

Bransys ELD

CISA reports 3 vulnerabilities in Bransys Android, iOS. Weakness types: Use of Hard-coded Credentials, Cleartext Transmission of Sensitive Information. Successful exploitation of these vulnerabilities could allow unauthorized access to telemetry data and firmware. Highest CVSS v3 score: 7.5 (High), exploitable over the…

What to do: Prioritize: Bransys recommends that users update their system through the app store. Android users should be on version 11.00.00 or newer. iOS users should be on version 1.1.54 or newer.

High 7.5 ICSA-26-258-08 · Sep 15, 2026 · CareCam

CareCam CM2507

CISA reports 7 vulnerabilities in CareCam HMT.CM2507 Firmware. Weakness types: Missing Authentication for Critical Function, Empty Password in Configuration File, Inclusion of Functionality from Untrusted Control Sphere (+2 more). Successful exploitation of these vulnerabilities could allow an attacker to access live v…

What to do: Prioritize: CareCam has not responded to CISA's attempts to coordinate. Users are encouraged to reach out to CareCam for more information.

Medium 6.1 ICSA-26-258-07 · Sep 15, 2026 · Siemens

Siemens Teamcenter

CISA reports 1 vulnerability in Siemens Teamcenter V2412, Teamcenter V2506, Teamcenter V2512, Teamcenter V2606. Weakness type: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). A reflected cross site scripting vulnerability in the authentication redirect flow (/auth/) of Teamcenter a…

What to do: Plan: Update to V2412.0013 or later version

High 8.7 ICSA-26-258-06 · Sep 15, 2026 · Siemens

Siemens Mendix SAML

CISA reports 1 vulnerability in Siemens Mendix SAML (Mendix 10 compatible), Mendix SAML (Mendix 11 compatible), Mendix SAML (Mendix 9.24 compatible). Weakness type: Improper Verification of Cryptographic Signature. Mendix SAML module contains a vulnerability that could allow unauthenticated remote attackers to hijack a…

What to do: Prioritize: Update to V3.6.27 or later version

Critical 9.8 Oil & gas relevant ICSA-26-258-05 · Sep 15, 2026 · Siemens

Siemens Reyrolle 7SR5

CISA reports 14 vulnerabilities in Siemens Reyrolle 7SR5. Weakness types: Integer Overflow or Wraparound, Improper Neutralization of Delimiters, Use of Out-of-range Pointer Offset (+8 more). Siemens Reyrolle 7SR5 Before V2.70 is affected by multiple vulnerabilities. Siemens has released a new version for Reyrolle 7SR5 …

What to do: Act now: Update to V2.70 or later version

Medium 6.5 Oil & gas relevant ICSA-26-258-04 · Sep 15, 2026 · Schneider Electric

Schneider Electric SCADAPack x70 Products

CISA reports 1 vulnerability in Schneider Electric SCADAPack 47x, SCADAPack 47xi, SCADAPack 47xd, SCADAPack 470R and 3 more. Weakness type: Insufficiently Protected Credentials. Schneider Electric is aware of a vulnerability in its SCADAPack x70 products. The SCADAPack 47x, SCADAPack 47xi, SCADAPack 47xd, SCADAPack 470…

What to do: Plan: Implement the Role-Based Access Control (RBAC) feature and follow the SCADAPack documentation sections Security Guidelines for Administrators and Working with Role-Based Access Control.

Critical 9.8 ICSA-26-258-03 · Sep 15, 2026 · mySCADA Technologies

mySCADA myPRO Manager

CISA reports 2 vulnerabilities in mySCADA Technologies mySCADA myPRO Manager. Weakness types: Missing Authorization, Missing Authentication for Critical Function. Successful exploitation of these vulnerabilities could allow an attacker to access privileged management functions or send arbitrary SMS messages through the…

What to do: Act now: mySCADA Technologies has addressed these issues in Version 2.2 and recommends that users update to the latest version.

High 8.3 Update ICSA-26-258-02 · Sep 15, 2026 · Wärtsilä

Wärtsilä FOS-Onboard (Update A)

CISA reports 2 vulnerabilities in Wärtsilä FOS-Onboard. Weakness type: Use of Hard-coded Cryptographic Key. Successful exploitation of these vulnerabilities could allow an attacker to deliver an unauthorized update, execute code, or extract credentials to allow the attacker to impersonate a privileged client. Highest C…

What to do: Prioritize: Wärtsilä states that the vulnerabilities are not exploitable when the product is installed as recommended, and has developed a security patch. The patch (version 5.08.4052.01) can be found on the Wärtsilä FOS download site.

Critical 9.6 ICSA-26-258-01 · Sep 15, 2026 · Digital Watchdog

Digital Watchdog VMAX DVR and NVR Product Lineups

CISA reports 6 vulnerabilities in Digital Watchdog VMAX A1 G4 DVRs, VMAX IP G4 NVRs, VMAX A1 PLUS, VA1G4 Recorder and 1 more. Weakness types: Missing Authentication for Critical Function, Use of Hard-coded Credentials, Missing Authorization (+1 more). Successful exploitation of these vulnerabilities could grant full ad…

What to do: Prioritize: Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at https://digital-watchdog.com/downloads/.

High 8.8 ICSA-26-254-01 · Sep 11, 2026 · CISA

CISA Malcolm

CISA reports 15 vulnerabilities in CISA Malcolm. Weakness types: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'…

What to do: Prioritize: The latest version of Malcolm (September 2026 or later) fixes these vulnerabilities. Affected users are encouraged to update their instance of Malcolm to the latest version.

High 8.4 Oil & gas relevant ICSA-26-253-01 · Sep 10, 2026 · AVEVA

AVEVA Pipeline Integrity Monitor

CISA reports 4 vulnerabilities in AVEVA Pipeline Integrity Monitor. Weakness types: Use of Hard-coded Cryptographic Key, Use of a Broken or Risky Cryptographic Algorithm, Missing Authorization (+1 more). Successful exploitation of these vulnerabilities could allow an attacker to disclose information, brute-force hashes…

What to do: Prioritize: AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation.

Medium 6.8 ICSA-26-251-01 · Sep 8, 2026 · CareCam

CareCam Pro IP Cameras

CISA reports 1 vulnerability in CareCam ANJIA AJL33PC0801 Firmware. Weakness type: Use of Hard-coded Credentials. Successful exploitation of this vulnerability could allow an attacker to take full control of the device. Highest CVSS v3 score: 6.8 (Medium), not remotely exploitable per its CVSS vector.

What to do: Plan: CareCam has not responded to CISA's attempts for coordination. Users are encouraged to reach out to CareCam.

High 8.8 ICSA-26-246-08 · Sep 3, 2026 · Tycon Systems

Tycon Systems TPDIN-Monitor-WEB3

CISA reports 3 vulnerabilities in Tycon Systems TPDIN-Monitor-WEB3. Weakness types: Use of Hard-coded Credentials, Cross-Site Request Forgery (CSRF), Missing Authorization. Successful exploitation of these vulnerabilities could allow for an attacker to perform a man-in-the-middle (MitM) attack, cause a factory reset, w…

What to do: Prioritize: Tycon Systems has released TPDIN-Monitor-WEB3 Firmware v2.4.2.

Critical 9.8 Oil & gas relevant ICSA-26-246-07 · Sep 3, 2026 · Pyramid Solutions

Pyramid Solutions NetStaX EtherNet/IP Stack

CISA reports 1 vulnerability in Pyramid Solutions EtherNet/IP Adapter DLL Kit (EIPA), EtherNet/IP Adapter DLL Kit with CIP Security (EIPA-SECURE), EtherNet/IP Adapter Development Kit (EADK), EtherNet/IP Adapter Development Kit with CIP Security (EADK-SECURE) and 4 more. Weakness type: Stack-based Buffer Overflow. Succe…

What to do: Act now: NetStaX v5.6.1 addresses this issue with multiple layers of protection, including a compile-time assertion, a runtime payload-size check, and clearer documentation of the relationships between packet and buffer-size constants.

High 8.8 Oil & gas relevant ICSA-26-246-06 · Sep 3, 2026 · Inductive Automation

Inductive Automation Ignition

CISA reports 1 vulnerability in Inductive Automation Ignition. Weakness type: Incorrect Default Permissions. Successful exploitation of this vulnerability could allow any authenticated user to create projects. Highest CVSS v3 score: 8.8 (High), exploitable over the network.

What to do: Prioritize: Inductive Automation recommends users upgrade to 8.1.54 or later (or the latest 8.3 version), which restricts project creation to Designer sessions and no longer relies on this setting.

High 7.5 Oil & gas relevant ICSA-26-246-05 · Sep 3, 2026 · Rockwell Automation

Rockwell Automation 1756-ENBT Module

CISA reports 1 vulnerability in Rockwell Automation 1756-ENBT module. Weakness type: Improper Check for Unusual or Exceptional Conditions. Successful exploitation of this vulnerability could crash the module. The device requires a restart to recover. Highest CVSS v3 score: 7.5 (High), exploitable over the network.

What to do: Prioritize: Rockwell Automation recommends that users upgrade to 1756-EN2T or 1756-EN4TR. Users who are not able to upgrade should use Rockwell Automation's security best practices.

High 7.5 Oil & gas relevant ICSA-26-246-04 · Sep 3, 2026 · Rockwell Automation

Rockwell Automation ArmorStart LT

CISA reports 2 vulnerabilities in Rockwell Automation ArmorStart LT. Weakness types: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Allocation of Resources Without Limits or Throttling. Successful exploitation of these vulnerabilities could result in a loss of webserver availabili…

What to do: Prioritize: Rockwell Automation has corrected this issue in firmware version v2.002, and encourages all users to update to the newest version.

High 7.3 Oil & gas relevant ICSA-26-246-03 · Sep 3, 2026 · Rockwell Automation

Rockwell Automation ControlFLASH

CISA reports 1 vulnerability in Rockwell Automation ControlFLASH. Weakness type: Missing Authentication for Critical Function. Successful exploitation of this vulnerability could give an attacker the ability to run any commands or code of the attacker's choice on a target machine at the logged-in user's permission leve…

What to do: Prioritize: Rockwell Automation has corrected this issue in software version 15.08, and encourages all users to update to the newest version.

Critical 9.6 Oil & gas relevant ICSA-26-246-02 · Sep 3, 2026 · IXON

IXON VPN Client

CISA reports 1 vulnerability in IXON VPN Client. Weakness type: Improper Neutralization of CRLF Sequences ('CRLF Injection'). Successful exploitation of this vulnerability could allow an attacker to perform remote code execution on the computer running the client with elevated privileges. Highest CVSS v3 score: 9.6 (Cr…

What to do: Act now: IXON recommends updating the IXON VPN client to version 1.4.7 or later on every computer where it is installed.

Medium 4.6 Oil & gas relevant ICSA-26-246-01 · Sep 3, 2026 · OPCFoundation

OPCFoundation OPC UA LocalDiscoveryServer (LDS)

CISA reports 1 vulnerability in OPCFoundation UA-LDS-Installers. Weakness type: Execution with Unnecessary Privileges. Successful exploitation of this vulnerability could allow an attacker to take control of a high-privilege terminal during installation and run arbitrary commands. Highest CVSS v3 score: 4.6 (Medium), n…

What to do: Plan: OPCFoundation recommends users update to OPC UA LDS Installers 1.04.420 or later.

High 8.0 Oil & gas relevant ICSA-26-244-06 · Sep 1, 2026 · Rockwell Automation

Rockwell Automation Historian ME

CISA reports 2 vulnerabilities in Rockwell Automation Series B, Series C. Weakness types: Out-of-bounds Write, Stack-based Buffer Overflow. Successful exploitation of these vulnerabilities could crash the device being accessed; an out-of-bounds write condition may allow remote code execution. Highest CVSS v3 score: 8.0…

What to do: Prioritize: Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices found at…

High 7.5 Oil & gas relevant ICSA-26-244-05 · Sep 1, 2026 · Rockwell Automation

Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix

CISA reports 1 vulnerability in Rockwell Automation ControlLogix 5580, GuardLogix 5580, CompactLogix 5380, Compact GuardLogix 5380 and 1 more. Weakness type: Loop with Unreachable Exit Condition ('Infinite Loop'). Successful exploitation of this vulnerability could result in a major nonrecoverable fault (MNRF), requiri…

What to do: Prioritize: Rockwell Automation recommends users update to firmware version 34.015 and later.

High 7.8 Oil & gas relevant ICSA-26-244-04 · Sep 1, 2026 · Rockwell Automation

Rockwell Automation FactoryTalk Activation Manager

CISA reports 1 vulnerability in Rockwell Automation FactoryTalk Activation Manager. Weakness type: Improper Restriction of Excessive Authentication Attempts. Successful exploitation of this vulnerability could allow an authenticated attacker to obtain SYSTEM-level access, granting full control over all files, processes…

What to do: Prioritize: Rockwell Automation recommends users update to software version V5.03.

High 7.5 Oil & gas relevant ICSA-26-244-03 · Sep 1, 2026 · Rockwell Automation

Rockwell Automation Logix Platform

CISA reports 1 vulnerability in Rockwell Automation ControlLogix 5580, CompactLogix 5380, GuardLogix 5580, Compact GuardLogix 5380. Weakness type: Improper Restriction of Operations within the Bounds of a Memory Buffer. Successful exploitation of this vulnerability could result in a major nonrecoverable fault (MNRF), r…

What to do: Prioritize: Rockwell Automation recommends users update to firmware version V37.011.

High 7.3 Oil & gas relevant ICSA-26-244-02 · Sep 1, 2026 · Rockwell Automation

Rockwell Automation Redundancy Module Configuration Tool

CISA reports 2 vulnerabilities in Rockwell Automation Redundancy Module Configuration Tool. Weakness type: Incorrect Default Permissions. Successful exploitation of these vulnerabilities could allow for an attacker to escalate and execute processes with administrator privileges. Highest CVSS v3 score: 7.3 (High), not r…

What to do: Prioritize: Rockwell Automation has released Redundancy Module Configuration Tool version 10.01.00 for users to install.

High 8.6 Oil & gas relevant ICSA-26-244-01 · Sep 1, 2026 · Rockwell Automation

Rockwell Automation RSLinx Classic

CISA reports 4 vulnerabilities in Rockwell Automation RSLinx Classic. Weakness types: Integer Overflow or Wraparound, Integer Underflow (Wrap or Wraparound), Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'). Successful exploitation of these vulnerabilities could allow an attacker to cause a denial…

What to do: Prioritize: Rockwell Automation has corrected the vulnerabilities in RSLinx Classic version 4.60.

Critical 9.8 ICSA-26-239-05 · Aug 27, 2026 · Ebyte

Ebyte NA111-M

CISA reports 13 vulnerabilities in Ebyte NA111-M Firmware. Weakness types: Missing Authentication for Critical Function, Use of GET Request Method With Sensitive Query Strings, Cross-Site Request Forgery (CSRF) (+8 more). Successful exploitation of these vulnerabilities could allow an attacker to fully compromise the d…

What to do: Act now: Ebyte acknowledged receipt of the reported vulnerabilities and indicated that a patch was under development.

Critical 9.8 Oil & gas relevant ICSA-26-239-04 · Aug 27, 2026 · Applied Systems Engineering

Applied Systems Engineering ASE2000 V2 Communications Test Set

CISA reports 2 vulnerabilities in Applied Systems Engineering ASE2000. Weakness types: Improper Restriction of XML External Entity Reference, Improper Certificate Validation. Successful exploitation of these vulnerabilities could allow an attacker to read or write arbitrary local files, cause the application to issue o…

What to do: Act now: All customers running ASE2000 versions 2.25 through 2.37 are affected by this issue and are required to upgrade to version 2.38 or later to apply the security fix.

Medium 6.8 ICSA-26-239-03 · Aug 27, 2026 · Rockwell Automation

Rockwell Automation OTTO Fleet Manager

CISA reports 1 vulnerability in Rockwell Automation OTTO Fleet Manager. Weakness type: Use of Password Hash With Insufficient Computational Effort. Successful exploitation of this vulnerability could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password ha…

What to do: Plan: See Rockwell Automation security advisory SD1791 for more information about this issue and instructions to enable encrypted system backup in OTTO Fleet Manager.

High 8.7 Known exploited ICSA-26-239-02 · Aug 27, 2026 · All-Line Equipment Company

All-Line Equipment Company Fuel-Boss

CISA reports 2 vulnerabilities in All-Line Equipment Company Fuel-Boss V1 Standard, Fuel-Boss V1 Portal, Fuel-Boss V1 Master/Slave, Fuel-Boss V1 Backflush Systems. Weakness types: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'), Buffer Copy without Checking Size of Input ('Classic Buf…

What to do: Act now: Fixes are available for the Fuel-Boss V1 Standard and Fuel-Boss V1 Portal. Please contact All-Line Equipment Company (866-356-3336) for instructions on how to receive these fixes.

Critical 9.8 ICSA-26-239-01 · Aug 27, 2026 · Xiiaozet

Xiiaozet LK100W

CISA reports 3 vulnerabilities in Xiiaozet LK100W. Weakness types: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Missing Authentication for Critical Function, Authentication Bypass Using an Alternate Path or Channel. Successful exploitation of these vulnerabilities could al…

What to do: Act now: Xiiaozet recommends users update to v2.1.240.

Critical 9.1 ICSA-26-237-07 · Aug 25, 2026 · FURUNO ELECTRIC CO.,LTD.

FURUNO FA-50 Class B AIS Transponder

CISA reports 2 vulnerabilities in FURUNO ELECTRIC CO.,LTD. FURUNO FA-50 Class B AIS Transponder. Weakness types: Use of Hard-coded Credentials, Missing Authentication for Critical Function. Successful exploitation of these vulnerabilities could allow an attacker to alter device settings. Highest CVSS v3 score: 9.1 (Cri…

What to do: Act now: FURUNO ELECTRIC CO.,LTD. notes that production of this product ended in October 2020, and software updates will no longer be provided. FURUNO recommends users do not connect the product directly to the internet.

Critical 9.8 ICSA-26-237-06 · Aug 25, 2026 · Ebyte

Ebyte NE2-D11

CISA reports 11 vulnerabilities in Ebyte NE2-D11 Firmware. Weakness types: Missing Authentication for Critical Function, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials (+6 more). Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized administ…

What to do: Act now: Ebyte acknowledged receipt of the reported vulnerabilities and indicated that a patch was under development.

High 7.5 ICSA-26-237-05 · Aug 25, 2026 · Bendix

Bendix EC80 Brake ECU

CISA reports 3 vulnerabilities in Bendix EC80ESP+ J1708, EC80ESP+ 6S/6M, EC80ESP+ PLC, EC80ESP+ 2nd CAN and 6 more. Weakness types: Stack-based Buffer Overflow, Out-of-bounds Write, Use of Hard-coded Credentials. Successful exploitation of these vulnerabilities could allow an attacker to cause the loss of ABS functions…

What to do: Prioritize: EC80ESP+ J1708: Z228999 users should update their firmware to version Z300822.

High 8.8 ICSA-26-237-04 · Aug 25, 2026 · PayRange

PayRange API

CISA reports 1 vulnerability in PayRange PayRange API. Weakness type: Missing Authorization. Successful exploitation of this vulnerability could allow a remote, authenticated or unauthenticated attacker to disclose sensitive information, arbitrarily modify the device to cause a denial of service, or alter a devices dis…

What to do: Prioritize: PayRange has not responded to requests to work with CISA to mitigate this vulnerability. Users of PayRange devices are invited to contact PayRange customer support at [email protected] for additional information.

Critical 10.0 Oil & gas relevant ICSA-26-237-03 · Aug 25, 2026 · Siemens

Siemens SIMATIC IoT2050 Advanced

CISA reports 1 vulnerability in Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2). Weakness type: Missing Authentication for Critical Function. SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed contain a missing authentication vulnerability in the Node-RED HTTP interface that could allo…

What to do: Act now: Update to V4.3.4.1 or later version

High 8.8 ICSA-26-237-02 · Aug 25, 2026 · Zoneminder

Zoneminder

CISA reports 1 vulnerability in Zoneminder Zoneminder. Weakness type: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). Successful exploitation of this vulnerability could result in full Remote Code Execution (RCE) as the web server user. Highest CVSS v3 score: 8.8 (High), expl…

What to do: Prioritize: Zoneminder recommends upgrading to version 1.38.3 or later by downloading the installer for your system at: https://zoneminder.com/downloads.

High 8.1 ICSA-26-237-01 · Aug 25, 2026 · Rently

Rently Smart Home

CISA reports 1 vulnerability in Rently Smart Home. Weakness type: Insufficiently Protected Credentials. Successful exploitation of this vulnerability could allow an attacker to access sensitive information and override user permissions. Highest CVSS v3 score: 8.1 (High), exploitable over the network.

What to do: Prioritize: Rently has patched this vulnerability in late June. No user action is required.

Medium 5.8 ICSA-26-232-01 · Aug 20, 2026 · Johnson Controls

Johnson Controls Simplex Incident Manager

CISA reports 1 vulnerability in Johnson Controls Simplex Incident Manager. Weakness type: Cleartext Storage of Sensitive Information in Memory. Successful exploitation of this vulnerability could allow a local attacker with low privileges to extract user credentials (passwords and authentication tokens) from system mem…

What to do: Plan: Johnson Controls has released a patched version (v2.01.01) to address this vulnerability.

High 7.8 ICSA-26-230-02 · Aug 18, 2026 · Siemens

Siemens Simcenter Nastran

CISA reports 1 vulnerability in Siemens Simcenter Femap, Simcenter Nastran. Weakness type: Stack-based Buffer Overflow. Simcenter Nastran is affected by a stack overflow vulnerability that could be triggered when an application binary reads arbitrary string as a file argument. Highest CVSS v3 score: 7.8 (High), not rem…

What to do: Prioritize: Update to V2606 or later version

High 8.8 ICSA-26-230-01 · Aug 18, 2026 · CISA

CISA Malcolm

CISA reports 6 vulnerabilities in CISA Malcolm. Weakness types: Allocation of Resources Without Limits or Throttling, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Unrestricted Upload of File with Dangerous Type (+2 more). Successful exploitation of these vulnerabilities could allow an…

What to do: Prioritize: Malcolm version 26.07.0 addresses these issues. For more information, see https://github.com/cisagov/Malcolm/pull/1043. (CVE-2026-63133, CVE-2026-63134, CVE-2026-63177)

High 8.0 ICSA-26-225-14 · Aug 13, 2026 · Johnson Controls

Johnson Controls Metasys

CISA reports 1 vulnerability in Johnson Controls Metasys 12, Metasys 13, Metasys 14, Metasys 15. Weakness type: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Successful exploitation of this vulnerability could allow a low-privilege user or attacker to inject a persistent maliciou…

What to do: Prioritize: Metasys 15.0: Patch released 2026-03-25

Medium 6.8 Oil & gas relevant ICSA-26-225-13 · Aug 13, 2026 · Siemens

Siemens LOGO! Soft Comfort

CISA reports 2 vulnerabilities in Siemens LOGO! Soft Comfort. Weakness types: Use of Hard-coded Cryptographic Key, Use of a One-Way Hash without a Salt. Siemens LOGO! Soft Comfort contains multiple vulnerabilities in its project-file encryption and password handling mechanisms. A local attacker could exploit these vuln…

What to do: Plan: Update to V9 or later version Note: A hardware upgrade to LOGO! V9 BM or later is also required to avoid compatibility mode, in which the vulnerabilities addressed by this advisory remain present.

High 7.8 ICSA-26-225-12 · Aug 13, 2026 · Siemens

Siemens Solid Edge

CISA reports 7 vulnerabilities in Siemens Solid Edge SE2025, Solid Edge SE2026. Weakness types: Out-of-bounds Read, Out-of-bounds Write, Use After Free. Solid Edge is affected by multiple file parsing vulnerabilities that could be triggered when the application reads specially crafted files in PAR, PSM or DFT format. T…

What to do: Prioritize: Update to V225.0 Update 15 or later version

High 7.8 ICSA-26-225-11 · Aug 13, 2026 · Siemens

Siemens Simcenter Femap

CISA reports 2 vulnerabilities in Siemens Simcenter Femap. Weakness type: Out-of-bounds Read. Simcenter Femap contains two file parsing vulnerabilities that could be triggered when the application reads files in BMP file format. Highest CVSS v3 score: 7.8 (High), not remotely exploitable per its CVSS vector.

What to do: Prioritize: Update to V2606.0001 or later version

High 7.8 ICSA-26-225-10 · Aug 13, 2026 · Siemens

Siemens Parasolid

CISA reports 1 vulnerability in Siemens Parasolid V38.0, Parasolid V38.1. Weakness type: Out-of-bounds Read. Parasolid is affected by an out of bounds read vulnerability that could be triggered when the application reads files in X_T format. This could allow an attacker to crash the application or execute arbitrary cod…

What to do: Prioritize: Update to V38.0.235 or later version

Critical 9.1 ICSA-26-225-09 · Aug 13, 2026 · Siemens

Siemens Siveillance Video

CISA reports 1 vulnerability in Siemens Siveillance Video V2023 R3, Siveillance Video V2024 R1, Siveillance Video V2025. Weakness type: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). Siveillance Video Management Servers contains a vulnerability that could allow a Remote Code…

What to do: Act now: Update to V23.3 HotfixRev27 or later version

Medium 4.3 ICSA-26-225-08 · Aug 13, 2026 · Siemens

Siemens Desigo DXR and PXC Controllers

CISA reports 1 vulnerability in Siemens Desigo DXR2, Desigo PXC3, Desigo PXC4, Desigo PXC5.E003 and 2 more. Weakness type: Improper Check for Unusual or Exceptional Conditions. A vulnerability in Desigo DXR and PXC controllers has been identified that could allow an attacker to cause denial of service conditions by sen…

What to do: Plan: Update to V01.21.233.16-7862 or later version Please contact your local Siemens office for additional support in obtaining the update.

High 7.5 ICSA-26-225-07 · Aug 13, 2026 · Siemens

Siemens License Server (SLS)

CISA reports 2 vulnerabilities in Siemens Siemens License Server (SLS). Weakness types: Incorrect Permission Assignment for Critical Resource, Path Traversal: '.../...//'. Siemens License Server is affected by multiple vulnerabilities which could allow an attacker to elevate its privileges and read arbitrary files on t…

What to do: Prioritize: Update to V5.1 or later version

Medium 6.1 Oil & gas relevant ICSA-26-225-06 · Aug 13, 2026 · Siemens

Siemens RUGGEDCOM APE1808

CISA reports 2 vulnerabilities in Siemens RUGGEDCOM APE1808. Weakness types: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Fortinet has published information on vulnerabilities in FortiOS. This adviso…

What to do: Plan: Review the vendor guidance linked in the source advisory and apply CISA's recommended practices.

High 8.1 ICSA-26-225-05 · Aug 13, 2026 · ANDRITZ

ANDRITZ HIPASE-250 and 250 SCALA

CISA reports 4 vulnerabilities in ANDRITZ HIPASE-250, 250 SCALA. Weakness types: Storing Passwords in a Recoverable Format, Missing Authentication for Critical Function, Use of Hard-coded Credentials. Successful exploitation of these vulnerabilities could allow an attacker to read data from the device or gain access to…

What to do: Prioritize: ANDRITZ has addressed these issues in version V8.00.00 (released 2024-12) and in version V8.15.00 (released 2026-07) and encourages users to keep their systems updated to the latest version (currently HIPASE-250 Version V8.15.00).

High 8.8 Oil & gas relevant ICSA-26-225-04 · Aug 13, 2026 · Hitachi Energy

Hitachi Energy APM Edge Product

CISA reports 2 vulnerabilities in Hitachi Energy APM Edge. Weakness types: Write-what-where Condition, Out-of-bounds Write. Hitachi Energy is aware of Dirty Frag vulnerabilities that affect APM Edge product versions listed in this document. Successful exploitation of these vulnerabilities could result in impact on conf…

What to do: Prioritize: Disable the esp4 and esp6 modules [2]

Medium 6.8 ICSA-26-225-03 · Aug 13, 2026 · Johnson Controls

Johnson Controls Inc. Airwall

CISA reports 2 vulnerabilities in Johnson Controls Airwall. Weakness types: Use of Hard-coded Cryptographic Key, External Control of File Name or Path. Successful exploitation of these vulnerabilities could allow an attacker to decrypt sensitive data, bypass authentication controls, gaining unauthorized access to read …

What to do: Plan: To help reduce risk of exploitation, Johnson Controls recommends the following defensive measures: Apply v4.1.0 or later patches for all Airwalls.

Critical 10.0 ICSA-26-225-02 · Aug 13, 2026 · Haiwell

Haiwell IoT Cloud HMI Gateway

CISA reports 1 vulnerability in Haiwell Haiwell IoT Cloud HMI Gateway. Weakness type: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). Successful exploitation of this vulnerability may allow an attacker to inject and execute arbitrary OS commands with root privileges. Highest …

What to do: Act now: Haiwell has addressed the issue in patch version number Scada-v3.50.1.19, which is available for download on their website: https://en.haiwell.com/app/system/entrance.php?m=include&c=access&a=dodown&lang=en&id=361

High 7.1 Oil & gas relevant ICSA-26-225-01 · Aug 13, 2026 · AVEVA

AVEVA Enterprise SCADA

CISA reports 1 vulnerability in AVEVA Enterprise SCADA, Enterprise SCADA HMI. Weakness type: Deserialization of Untrusted Data. Successful exploitation of this vulnerability could allow an attacker to tamper with serialized data, potentially resulting in code execution during deserialization. Highest CVSS v3 score: 7.1…

What to do: Prioritize: AVEVA recommends that customers using affected product versions should perform the following to mitigate the risk of exploit: 1.

High 7.1 ICSA-26-219-01 · Aug 7, 2026 · CPDLC

CPDLC over ATN-B1 Vulnerabilities

CISA reports 5 vulnerabilities in CPDLC ATN-B1 CPDLC. Weakness types: Missing Authentication for Critical Function, Allocation of Resources Without Limits or Throttling, Improper Check for Unusual or Exceptional Conditions. ATN-B1 CPDLC relies on legacy clear text unauthenticated radio frequency links. Research demonst…

What to do: Prioritize: These vulnerabilities in the CPDLC protocol stack are exploitable in a lab environment. However, they require very specific conditions to be met and are unlikely to be exploited outside of a lab setting. The vendor lists no fix for some issues, so lean on mitigations.

Medium 4.1 ICSA-26-218-02 · Aug 6, 2026 · Johnson Controls

Johnson Controls Inc. TL280

CISA reports 1 vulnerability in Johnson Controls TL280. Weakness type: Use of a Broken or Risky Cryptographic Algorithm. Successful exploitation of this vulnerability could allow an attacker to access sensitive information on the device. Highest CVSS v3 score: 4.1 (Medium), exploitable over the network.

What to do: Plan: To help reduce the risk of exploitation, Johnson Control suggests considering the following defensive measures: Apply firmware update 5.63.

High 7.8 Known exploited Oil & gas relevant ICSA-26-218-01 · Aug 6, 2026 · ABB

ABB Ability Zenon

CISA reports 13 vulnerabilities in ABB Ability Zenon, IIoT services with MongoDB. Weakness types: Improper Handling of Length Parameter Inconsistency, Improper Neutralization of Null Byte or NUL Character, Collapse of Data into Unsafe Value (+9 more). ABB is aware of publicly reported vulnerabilities affecting MongoDB …

What to do: Act now: ABB recommends the following mitigation measures: - Replace bundled MongoDB with a supported version if IIoT services are required: - Where IIoT functionality is required, the bundled MongoDB instance can be replaced with a supported and…

High 8.1 ICSA-26-216-01 · Aug 4, 2026 · Acrisure

Acrisure KARR BT and DR-100

CISA reports 1 vulnerability in Acrisure KARR BT, DR-100. Weakness type: Use of Hard-coded Cryptographic Key. Successful exploitation of this vulnerability could allow an attacker to perform unauthorized vehicle control operations. Highest CVSS v3 score: 8.1 (High), exploitable from an adjacent network.

What to do: Prioritize: Acrisure Protection Group released a firmware update on July 20, 2026, to address this vulnerability.

Medium 6.5 ICSA-26-211-11 · Jul 30, 2026 · MZ Automation

MZ Automation lib60870

CISA reports 2 vulnerabilities in MZ Automation lib60870. Weakness type: Out-of-bounds Read. Successful exploitation of these vulnerabilities could crash the device being accessed. Highest CVSS v3 score: 6.5 (Medium), exploitable over the network.

What to do: Plan: See MZ Automation advisories for more information: https://github.com/mz-automation/lib60870/security/advisories/GHSA-g3w7-x5rx-83xm

High 7.5 ICSA-26-211-10 · Jul 30, 2026 · MZ Automation

MZ Automation GmbH libiec61850

CISA reports 8 vulnerabilities in MZ Automation libiec61850. Weakness type: Out-of-bounds Read. Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition on the device. Highest CVSS v3 score: 7.5 (High), exploitable over the network.

What to do: Prioritize: MZ Automation GmbH recommends that users update to version 1.6.2.

Medium 5.7 ICSA-26-211-09 · Jul 30, 2026 · Watchfire

Watchfire Controller Software

CISA reports 1 vulnerability in Watchfire BC550, BC750, BC760, BC760DC. Weakness type: Use of Hard-coded Cryptographic Key. Successful exploitation of this vulnerability could allow a malicious user the ability to deliver malicious firmware that can update and gain full control of the controller. Highest CVSS v3 score:…

What to do: Plan: Watchfire has issued patches to disable the use of the existing certificates. Users using BC550; 12.30 should upgrade to 12.31 SP1

High 8.8 ICSA-26-211-08 · Jul 30, 2026 · o6 Automation GmbH

o6 Automation open62541

CISA reports 4 vulnerabilities in o6 Automation GmbH open62541 on Windows and Linux. Weakness types: Integer Underflow (Wrap or Wraparound), Integer Overflow or Wraparound, Use After Free. Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information, cause a denial of servi…

What to do: Prioritize: o6 Automation has prepared mitigations and fixes to address these issues and recommends that users update to the newest version.

High 7.1 Oil & gas relevant Update ICSA-26-211-07 · Jul 30, 2026 · Mitsubishi Electric

Mitsubishi Electric CC-Link IE TSN Communication Protocol (Update A)

CISA reports 1 vulnerability in Mitsubishi Electric Mitsubishi Electric MELSEC MX Controller MX-R model MXR300-16, Mitsubishi Electric MELSEC MX Controller MX-R model MXR300-32, Mitsubishi Electric MELSEC MX Controller MX-R model MXR300-64, Mitsubishi Electric MELSEC MX Controller MX-R model MXR500-128 and 116 more. We…

What to do: Prioritize: For customers of the affected products, Mitsubishi Electric recommends restricting physical access to the affected products and the CC-Link IE TSN network to which the affected products are connected by taking measures such as the… The vendor lists no fix for some issues, so lean on mitigations.

High 7.5 ICSA-26-211-06 · Jul 30, 2026 · NASA

NASA Core Flight System (cFS) Health & Safety (HS) Application

CISA reports 1 vulnerability in NASA Core Flight System (cFS) Health & Safety (HS) Application. Weakness type: NULL Pointer Dereference. Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. Highest CVSS v3 score: 7.5 (High), exploitable over the network.

What to do: Prioritize: NASA reports that an official fix is currently under development and is expected to be included in a future software release.

Medium 5.9 Oil & gas relevant ICSA-26-211-05 · Jul 30, 2026 · Rockwell Automation

Rockwell Automation CompactLogix 5380 ControlLogix 5580 / 1756-EN4TR Communications Module

CISA reports 1 vulnerability in Rockwell Automation ControlLogix 5580, CompactLogix 5380, GuardLogix 5580, Compact GuardLogix 5380 and 1 more. Weakness type: Improper Check for Certificate Revocation. Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. Highest C…

What to do: Plan: Rockwell Automation recommend users update to the following versions: ControlLogix 5580: Update to V38.011

High 7.8 Oil & gas relevant ICSA-26-211-04 · Jul 30, 2026 · Schneider Electric

Schneider Electric IGSS

CISA reports 1 vulnerability in Schneider Electric IGSS, IGSS Definition (Def.exe) module. Weakness type: Out-of-bounds Write. Schneider Electric is aware of a vulnerability in its IGSS Definition module for the IGSS (Interactive Graphical SCADA System) product. The [IGSS](https://igss.schneider-electric.com/) product …

What to do: Prioritize: Version 18.0.0.26125 of the IGSS Definition module includes a fix for this vulnerability and is available for download through IGSS Master > Update IGSS Software or here:…

High 8.8 Oil & gas relevant ICSA-26-211-03 · Jul 30, 2026 · Toptech Systems

Toptech Systems RCU II+ and Multiload II+

CISA reports 1 vulnerability in Toptech Systems RCU II+, Multiload II+. Weakness type: Missing Authentication for Critical Function. Successful exploitation of this vulnerability could allow an attacker to gain full system control and misuse it to access or manipulate connected networks and resources. Highest CVSS v3 s…

What to do: Prioritize: Install the latest firmware from https://s3.amazonaws.com/docs.toptech.com/index.html#downloads/Firmware/RCUII+_MLII+_SMPII+/. *-* This method requires stopping the bay and breaking the W&M seal.

Low 2.4 ICSA-26-211-02 · Jul 30, 2026 · Johnson Controls

Johnson Controls OpenBlue Employee

CISA reports 3 vulnerabilities in Johnson Controls OpenBlue Employee (FMS Employee). Weakness types: Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). Succe…

What to do: Plan: Johnson Controls recommends the following defensive measures to help reduce the risk of exploitation: Apply the latest product update for OpenBlue Employee (FMS Employee).

Medium 4.9 ICSA-26-211-01 · Jul 30, 2026 · MikroTik

MikroTik RouterOS

CISA reports 1 vulnerability in MikroTik RouterOS. Weakness type: Insufficient Session Expiration. Successful exploitation of this vulnerability could allow an attacker to extract the router's WireGuard private key in plaintext using only low‑privilege API access, enabling full VPN impersonation and decryption of all a…

What to do: Plan: MikroTik recommends administrators to ensure that when a user's permissions are downgraded, the affected user is fully logged out so the new policy can take effect.

Medium 6.4 ICSA-26-209-07 · Jul 28, 2026 · ABB

ABB KNX Update Tool

CISA reports 1 vulnerability in ABB KNX Update Tool (ABB), KNX Update Tool (BJE). Weakness type: Missing Support for Integrity Check. ABB has been contacted by a researcher who identified a vulnerability in one of its products. ABB has been contacted by a researcher who identified a vulnerability in one of its products…

What to do: Plan: Due to the nature of the classic KNX protocol stack and security concept, there are no options to resolve the vulnerability with a software update on a technical level.

Medium 5.3 ICSA-26-209-06 · Jul 28, 2026 · igloohome

igloohome Smart Lock Mobile Application

CISA reports 1 vulnerability in igloohome Smart Lock Mobile Application (Android). Weakness type: Inclusion of Sensitive Information in Source Code. Successful exploitation of this vulnerability could allow an unauthorized actor to access functions or backend services. Highest CVSS v3 score: 5.3 (Medium), exploitable o…

What to do: Plan: igloohome have enhanced the access control mechanisms on backend services to ensure that only properly authenticated and authorized requests can interact with sensitive functionality. No user interaction is needed.

High 8.8 ICSA-26-209-05 · Jul 28, 2026 · MikroTik

MikroTik RouterOS and Cloud Hosted Router

CISA reports 1 vulnerability in MikroTik RouterOS, Cloud Hosted Router. Weakness type: Improper Restriction of Excessive Authentication Attempts. Successful exploitation of this vulnerability could allow attackers to rapidly guess passwords and gain unauthorized system access. Highest CVSS v3 score: 8.8 (High), exploit…

What to do: Prioritize: No fix is currently available from MikroTik. Until a fix is available, MikroTik recommends that users adopt the following mitigations: Use a strong VPN or other additional protection layer if the API is exposed to public networks.

Critical 9.8 Known exploited Oil & gas relevant ICSA-26-209-04 · Jul 28, 2026 · Siemens

Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP

CISA reports 352 vulnerabilities in Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0), SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0), SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0), SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) and 1 more. Weakness types: Missing Enc…

What to do: Act now: Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only. The vendor lists no fix for some issues, so lean on mitigations.

High 7.4 Oil & gas relevant ICSA-26-209-03 · Jul 28, 2026 · Siemens

Siemens SIMATIC S7-PLCSIM Advanced

CISA reports 1 vulnerability in Siemens SIMATIC S7-PLCSIM Advanced. Weakness type: Allocation of Resources Without Limits or Throttling. SIMATIC S7-PLCSIM Advanced contains a vulnerability that could allow an attacker to cause a denial of service condition. Siemens is preparing fix versions and recommends specific coun…

What to do: Prioritize: Disable the S7-PLCSIM Virtual Switch binding on the network adapter used by the affected instance. This prevents the adapter from entering an external communication mode and removes the attack vector entirely. The vendor lists no fix for some issues, so lean on mitigations.

Unknown ICSA-26-209-02 · Jul 28, 2026 · Siemens

Siemens Mendix Runtime

CISA reports 1 vulnerability in Siemens Mendix Runtime. Weakness type: Insecure Inherited Permissions. This advisory is revoked. Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected attribute.

What to do: Plan: Review the vendor guidance linked in the source advisory and apply CISA's recommended practices.

Critical 9.8 ICSA-26-209-01 · Jul 28, 2026 · Siemens

Siemens Desigo CC

CISA reports 1 vulnerability in Siemens Desigo CC family V7, Desigo CC family V8, Desigo CC family V9. Weakness type: Out-of-bounds Write. OpenSSL has published a stack based buffer overflow vulnerability that allows a remote attacker to cause a denial of service (DoS) or potentially allow for remote code execution. Si…

What to do: Act now: Update to V9.0 QU1 or later version

High 8.2 ICSA-26-204-07 · Jul 23, 2026 · MZ Automation

MZ Automation lib60870

CISA reports 1 vulnerability in MZ Automation lib60870. Weakness type: Out-of-bounds Read. Successful exploitation of this vulnerability could cause the parsing process to crash, which will cause a denial of service. Highest CVSS v3 score: 8.2 (High), exploitable over the network.

What to do: Prioritize: MZ automation recommends users update to version 2.4.1 or later. Documentation can be found at https://github.com/mz-automation/lib60870/security/advisories/GHSA-f5xp-w6f3-vvrv.

High 8.1 ICSA-26-204-06 · Jul 23, 2026 · MZ Automation

MZ Automation libIEC61850

CISA reports 4 vulnerabilities in MZ Automation libIEC61850. Weakness types: Stack-based Buffer Overflow, Heap-based Buffer Overflow, Improper Handling of Syntactically Invalid Structure (+1 more). Successful exploitation of these vulnerabilities could allow an unauthenticated network-adjacent attacker to crash critica…

What to do: Prioritize: MZ Automation recommends updating to the latest build of the libIEC61850 standard. Documentation can be found at https://github.com/mz-automation/libiec61850.

High 8.1 Oil & gas relevant ICSA-26-204-05 · Jul 23, 2026 · Rockwell Automation

Rockwell Automation ThinManager

CISA reports 1 vulnerability in Rockwell Automation ThinManager. Weakness type: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Successful exploitation of this vulnerability could allow an authenticated attacker to write arbitrary files to restricted system directories outside of the app…

What to do: Prioritize: ThinManager Versions 13.0.0 - 13.0.7 --> 13.0.8

Critical 10.0 ICSA-26-204-04 · Jul 23, 2026 · Pronetiqs

Panduit IntraVUE

CISA reports 5 vulnerabilities in Pronetiqs IntraVUE. Weakness types: Plaintext Storage of a Password, Unintended Proxy or Intermediary ('Confused Deputy'), Exposure of Sensitive System Information to an Unauthorized Control Sphere (+1 more). Successful exploitation of these vulnerabilities could allow an attacker with…

What to do: Act now: Pronetiqs advises users to update to the latest version of the IntraVUE software, version 3.2.1a16 or later.

High 8.8 ICSA-26-204-03 · Jul 23, 2026 · Weintek

Weintek cMT3092X

CISA reports 4 vulnerabilities in Weintek cMT3092X firmware, EasyWeb. Weakness types: Reliance on Cookies without Validation and Integrity Checking in a Security Decision, Incorrect Permission Assignment for Critical Resource, Plaintext Storage of a Password (+1 more). Successful exploitation of these vulnerabilities c…

What to do: Prioritize: Weintek recommends users apply the patch package named cmt_typeB_20260316_007.patch, which contains a newer EasyWeb 2.3.17-typeb. This fix will be delivered as a patch-only update; no separate standard firmware release is planned.

Low 3.3 ICSA-26-204-02 · Jul 23, 2026 · Johnson Controls

Johnson Controls XAAP Android

CISA reports 1 vulnerability in Johnson Controls XAAP Android. Weakness type: Cleartext Storage of Sensitive Information. Successful exploitation of this vulnerability could result in an attacker obtaining confidential information from the device. Highest CVSS v3 score: 3.3 (Low), not remotely exploitable per its CVSS …

What to do: Plan: Johnson Controls recommends users update the XAAP Android application to version 1.53 or later, which contains the fix for this vulnerability.

Critical 9.6 Update ICSA-26-204-01 · Jul 23, 2026 · Johnson Controls

Johnson Controls C-CURE 9000 and Victor application server (Update A)

CISA reports 3 vulnerabilities in Johnson Controls C-CURE 9000, victor Application Server, victor, victor Web. Weakness types: Server-Side Request Forgery (SSRF), Execution with Unnecessary Privileges. Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code ex…

What to do: Prioritize: Johnson Controls recommends the following upgrades to address the vulnerable deserialization path: Upgrade to C-CURE 9000 v3.20 or later

High 7.5 Oil & gas relevant ICSA-26-202-10 · Jul 21, 2026 · Rockwell Automation

Rockwell Automation Studio 5000 Logix Designer

CISA reports 3 vulnerabilities in Rockwell Automation Studio 5000 Logix Designer. Weakness types: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Incorrect Authorization, Unquoted Search Path or Element. Successful exploitation of these vulnerabilities could allow for a local attacker to…

What to do: Prioritize: Rockwell Automation recommends users to upgrade to the following: Studio 5000 Logix Designer: V37.00, 36.01, 35.02, 34.04, 33.04, 32.05 (CVE-2026-9108)

Low 3.7 Oil & gas relevant Update ICSA-26-202-09 · Jul 21, 2026 · Rockwell Automation

Rockwell Automation 1734 POINT I/O (Update A)

CISA reports 1 vulnerability in Rockwell Automation 1734 POINT I/O. Weakness type: Allocation of Resources Without Limits or Throttling. Successful exploitation of this vulnerability could allow for an attacker to cause a denial-of-service condition on the product. Highest CVSS v3 score: 3.7 (Low), exploitable over the…

What to do: Plan: Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices…

High 7.5 Oil & gas relevant ICSA-26-202-08 · Jul 21, 2026 · Rockwell Automation

Rockwell Automation 1718-AENTR/1719-AENTR

CISA reports 1 vulnerability in Rockwell Automation 1718/ 1719 Ex I/O. Weakness type: Allocation of Resources Without Limits or Throttling. Successful exploitation of this vulnerability could allow for an attacker to cause a denial-of-service condition on the product. Highest CVSS v3 score: 7.5 (High), exploitable over…

What to do: Prioritize: Rockwell Automation recommends users to upgrade to 1718/ 1719 Ex I/O version 3.012 or later.

High 7.8 Oil & gas relevant ICSA-26-202-07 · Jul 21, 2026 · Rockwell Automation

Rockwell Automation FactoryTalk Services Platform

CISA reports 1 vulnerability in Rockwell Automation FactoryTalk Directory (FTSP). Weakness type: Weak Authentication. Successful exploitation of this vulnerability could allow an attacker to impersonate an authorized user on the FTSP server, resulting in unauthorized access to system configurations. Highest CVSS v3 sco…

What to do: Prioritize: Users using FactoryTalk Services Platform v6.60 should apply either the individual patch (RAID 1158263) or the February 2026 Patch Roll-up, or later update.

Critical 9.8 Known exploited ICSA-26-202-06 · Jul 21, 2026 · Siemens

Siemens CADRA

CISA reports 11 vulnerabilities in Siemens CADRA. Weakness types: Improper Input Validation, Incorrect Bitwise Shift of Integer, Out-of-bounds Write (+3 more). CADRA is affected by multiple zlib and Foxit vulnerabilities. Siemens has released a new version for CADRA and recommends to update to the latest version. Sieme…

What to do: Act now: Update to V2511 or later version

Medium 6.7 ICSA-26-202-05 · Jul 21, 2026 · Siemens

Siemens IAM Client

CISA reports 1 vulnerability in Siemens COMOS V10.4.5, COMOS V10.6, Designcenter NX, Simcenter 3D and 12 more. Weakness type: Untrusted Search Path. Multiple Siemens products are affected by unquoted search path vulnerability in IAM Client. This could allow an authenticated local attacker to perform privilege escalatio…

What to do: Plan: Update to V10.6.1 or later version

Critical 9.8 ICSA-26-202-04 · Jul 21, 2026 · Siemens

Siemens SIDIS Secured SmartPlug

CISA reports 12 vulnerabilities in Siemens SIDIS Secured SmartPlug. Weakness types: Improper Enforcement of Message Integrity During Transmission in a Communication Channel, Reusing a Nonce, Key Pair in Encryption, Out-of-bounds Write (+6 more). SIDIS Secured SmartPlug before V7.26.0310 is affected by multiple vulnerab…

What to do: Act now: Update to V7.26.0310 or later version

Critical 10.0 ICSA-26-202-03 · Jul 21, 2026 · Siemens

Siemens Opcenter X

CISA reports 1 vulnerability in Siemens Opcenter X. Weakness type: Improper Verification of Cryptographic Signature. Opcenter X before V2604 contain an authentication bypass vulnerability that could allow an attacker to gain full unauthorized access to the application. Siemens has released a new version for Opcenter X …

What to do: Act now: Update to V2604 or later version

High 7.2 Oil & gas relevant ICSA-26-202-02 · Jul 21, 2026 · Siemens

Siemens RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW

CISA reports 3 vulnerabilities in Siemens RUGGEDCOM APE1808. Weakness types: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Missing Authorization, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). Palo Alto Networks has published [1] infor…

What to do: Prioritize: Review the vendor guidance linked in the source advisory and apply CISA's recommended practices.

Critical 9.8 Update ICSA-26-202-01 · Jul 21, 2026 · Tycon Systems

Tycon Systems TPDIN-Monitor-WEB2 (Update A)

CISA reports 2 vulnerabilities in Tycon Systems TPDIN-Monitor-WEB2. Weakness types: Missing Authentication for Critical Function, Cleartext Storage of Sensitive Information. Successful exploitation of these vulnerabilities could result in an attacker accessing sensitive credentials, disrupting connected infrastructure,…

What to do: Act now: Tycon Systems has released firmware 2.4.5, which resolves this vulnerability by requiring an administrator username and password to be set before the web interface is served. Further inquiries can be directed to [email protected].

Every ICS security advisory that matters to oil & gas, in plain English.