Advisories › Eclipse Foundation › ICSA-26-288-01
Eclipse Foundation Eclipse Milo: 6 CVEs, High 8.2
Summary
CISA reports 6 vulnerabilities in Eclipse Foundation Eclipse Milo. Weakness types: Incorrect Authorization, Missing Release of Memory after Effective Lifetime, Missing Authorization (+2 more). Successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients. Highest CVSS v3 score: 8.2 (High), exploitable over the network.
What to do: Prioritize: The Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5.
Why this matters for oil & gas: Eclipse Milo is an OPC UA library used in industrial connectivity software; Affected products include Milo.
At a glance
- Vendor
- Eclipse Foundation
- Products
- Eclipse Milo
- CVEs
- CVE-2026-62927, CVE-2026-63252, CVE-2026-58080, CVE-2026-63248, CVE-2026-60007, CVE-2026-61387
- Highest CVSS v3
- 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Chemical, Critical Manufacturing, Energy, Water and Wastewater Systems
- Deployed
- Worldwide
- Vendor HQ
- Belgium
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-62927 | Incorrect Authorization | 7.5 | – | No | In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method. |
| CVE-2026-63252 | Missing Release of Memory after Effective Lifetime | 7.5 | – | No | In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially terminating the server. |
| CVE-2026-58080 | Missing Authorization | 8.2 | – | No | In Eclipse Milo versions 1.0.0 through 1.1.4, OpcUaServerConfig.copy() fails to preserve a configured RoleMapper. On servers that rely on role permissions and construct the running configuration through copy(), sessions receive no role IDs and the default access controller skips role-permission checks, allowing an anonymous client where anonymous sessions are permitted to read role-permission meta… |
| CVE-2026-63248 | Missing Authorization | 6.5 | – | No | In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, secu… |
| CVE-2026-60007 | Observable Response Discrepancy | 7.4 | – | No | In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated ActivateSession requests as a padding oracle, recover the victim's password, and authenticate with the… |
| CVE-2026-61387 | Missing Release of Resource after Effective Lifetime | 5.3 | – | No | In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter can trigger a StackOverflowError during decoding, allowing an unauthenticated remote client to exhaust a finite global monitore… |
Affected products (2)
- Eclipse Foundation Eclipse Milo: >=0.6.0|<=1.1.4
- Eclipse Foundation Eclipse Milo: >=1.0.0|<=1.1.4
Vendor fixes and mitigations (from advisory)
- Vendor Fix: The Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5. link
- Mitigation: For users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later.
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.