CISA cyber & ICS and DC3 (DoD Cyber Crime Center / DCISE) threat products relevant to the DIB — each read by dex into a categorized card: the gist, why it matters, who's affected, and what to do.
Vulnerability
CISA ICS
2026-10-15
Critical vulnerabilities in Guangzhou Juan IoT Technology EseeCloud allow attackers to gain control of IP cameras via hard-coded credentials and improper attribute modification.
Successful exploitation of CVE-2026-107617, CVE-2026-97858, and CVE-2026-105664 in EseeCloud App <=4.9.6 and Firmware <=4.9.86.0 enables attackers to take control of affected IP cameras. The vendor has not responded to CISA coordination attempts, and users must contact the vendor for support.
AFFECTEDGuangzhou Juan IoT Technology EseeCloud AppGuangzhou Juan IoT Technology EseeCloud Firmware
▸ DO Patch EseeCloud App and Firmware to versions above 4.9.6 and 4.9.86.0 respectively, or isolate affected devices from the network.
#vulnerability#patch-available#critical-infrastructure#iot
Vulnerability
CISA ICS
2026-10-15
Eclipse Milo versions 1.0.0 through 1.1.4 contain critical authorization flaws allowing credential theft and data deletion.
Successful exploitation of CVE-2026-62927 and related vulnerabilities in Eclipse Milo allows attackers to execute denied methods, recover user credentials, and delete protected data. The flaws stem from incorrect authorization and missing resource release in the Call service dispatch.
AFFECTEDEclipse Milo
▸ DO Upgrade Eclipse Milo to a patched version immediately and review access controls for affected systems.
#vulnerability#patch-available#critical-infrastructure
Vulnerability
RCE
CISA ICS
2026-10-15
CISA Malcolm <=v26.08.0 contains multiple critical vulnerabilities including authentication bypasses and SSRF.
CISA Malcolm versions <=v26.08.0 are affected by six critical vulnerabilities (CVE-2026-107334 through CVE-2026-107362) including authentication bypasses, SSRF, and CSRF. These flaws impact critical infrastructure sectors like energy, IT, and water systems, allowing unauthenticated access to backend services.
AFFECTEDCISA Malcolm
▸ DO Upgrade CISA Malcolm to version >v26.08.0 immediately and verify authentication controls on Arkime backend proxies.
#rce#vulnerability#patch-available#critical-infrastructure#authentication-bypass#ssrf
Vulnerability
CISA ICS
2026-10-13
Swann Communications SWIFI-SE2KIC firmware <=2.0.22 has unauthenticated video access flaws.
Successful exploitation of CVE-2026-107605, CVE-2026-107606, and CVE-2026-107607 allows attackers to view live video feeds without authentication on the local network. DIBs using these cameras must patch or apply interim mitigations to prevent unauthorized surveillance.
AFFECTEDSwann Communications SWIFI-SE2KIC
▸ DO Update Swann Communications SWIFI-SE2KIC firmware to version 2.0.23 or later, or isolate devices behind a secured router and firewall.
#vulnerability#patch-available#mitigations
Vulnerability
RCE
CISA ICS
2026-10-13
Ignition Software privilege escalation flaw requires immediate patching for critical infrastructure sectors.
A vulnerability in Inductive Automation Ignition Software allows authenticated low-level users to escalate privileges to higher levels, enabling arbitrary code execution. Affected versions include Ignition >=8.1.0|<=8.1.54 and >=8.3.0|<=8.3.8, impacting critical manufacturing, energy, and IT sectors.
AFFECTEDInductive Automation Ignition
▸ DO Update Ignition Software to version 8.3.9 or 8.1.55 immediately.
#rce#vulnerability#patch-available#critical-infrastructure
Vulnerability
RCE
CISA ICS
2026-10-08
Satel Netco Design versions prior to v2.1.7 have a stored cross-site scripting vulnerability allowing script execution in user browsers.
A stored cross-site scripting (XSS) vulnerability exists in Satel Netco Design versions prior to v2.1.7, enabling authenticated users with Network Operator privileges to inject and execute arbitrary scripts in other users' browsers. Exploitation could lead to arbitrary code execution, file enumeration, and system resource consumption.
AFFECTEDSatel Netco Design
▸ DO Update Satel Netco Design to version 2.1.7 or later immediately.
#rce#vulnerability#patch-available#web-app
Vulnerability
CISA ICS
2026-10-08
Red Lion Controls N-Tron 700 Series switches have critical vulnerabilities allowing administrative access and continuous reboots.
Successful exploitation of these vulnerabilities allows a malicious user to gain administrative access, view/edit/upload configuration files, and cause continuous reboots by navigating to a specific URL. The affected devices are Red Lion Controls N-Tron 700 Series with Firmware <= 3.11.0 and Bootloader <= 2.0.6.1.
AFFECTEDRed Lion Controls N-Tron 700 Series
▸ DO Patch Red Lion Controls N-Tron 700 Series devices to Firmware 3.11.1 and Bootloader 2.0.6.2 immediately.
#vulnerability#patch-available#ot
Vulnerability
RCE
CISA ICS
2026-10-08
Grid Protection Alliance openPDC and openHistorian versions below 2.9.482 and 2.8.585 are vulnerable to multiple critical flaws including deserialization and SSRF.
Grid Protection Alliance openPDC and openHistorian software versions below 2.9.482 and 2.8.585 are affected by five critical vulnerabilities, including deserialization of untrusted data, missing authentication for critical functions, and server-side request forgery. These flaws could allow remote code execution and unauthorized access, posing a severe risk to energy sector infrastructure.
AFFECTEDGrid Protection Alliance openPDCGrid Protection Alliance openHistorian
▸ DO Upgrade openPDC to version 2.9.482 or higher and openHistorian to version 2.8.585 or higher immediately.
#rce#vulnerability#patch-available#ot#energy
Vulnerability
RCE
CISA ICS
2026-10-06
Critical buffer overflow in Savannah lwIP SMTP client 2.2.1 allows remote code execution.
A buffer overflow vulnerability (CVE-2026-15340) in Savannah lwIP SMTP client 2.2.1 enables remote code execution and device crashes. Affected sectors include energy, water, and wastewater systems.
AFFECTEDSavannah lwIP SMTP client 2.2.1
▸ DO Patch Savannah lwIP SMTP client 2.2.1 to version 2.2.2 or apply patch_125_smtp_txbuf.diff immediately.
#rce#vulnerability#patch-available#critical#energy#water
Vulnerability
CISA ICS
2026-10-06
Johnson Controls EasyIO FG firmware <=2.0b52 has critical vulnerabilities allowing full unauthorized device access.
Successful exploitation of CVE-2026-27872 and CVE-2026-27873 in Johnson Controls EasyIO FG firmware allows attackers to gain full unauthorized access via hard-coded credentials and improper privilege management. The product is End-of-Life with no patches available, requiring immediate operational mitigation.
AFFECTEDJohnson Controls EasyIO FG
▸ DO Identify and isolate any deployed Johnson Controls EasyIO FG devices and implement compensating controls such as network segmentation and strict access restrictions.
#vulnerability#patch-available#ot#critical-infrastructure
Vulnerability
RCE
CISA ICS
2026-10-06
Hitachi Energy SOI products with Apache ActiveMQ versions 2.0.0 to 2.2.0 have a critical RCE vulnerability.
A remote code execution vulnerability (CVE-2026-34197) exists in the Apache ActiveMQ component of Hitachi Energy SOI products. An authenticated attacker can exploit improper input validation and code injection to execute arbitrary code, compromising confidentiality, integrity, and availability.
AFFECTEDHitachi Energy SOI
▸ DO Apply the vendor's recommended immediate actions to patch or mitigate CVE-2026-34197.
#rce#vulnerability#patch-available#critical-infrastructure#energy
Vulnerability
RCE
CISA ICS
2026-10-06
Hitachi Energy RTU500 end-of-life firmware versions 11.x and prior are affected by legacy security vulnerabilities.
Dragos reported security findings in Hitachi Energy RTU500 CMU firmware versions 9.x and prior, which are end-of-life and no longer receive security updates. While currently supported versions are unaffected, legacy versions lack modern security controls and are at risk.
AFFECTEDHitachi Energy RTU500
▸ DO Upgrade to a currently supported RTU500 firmware version and implement defense-in-depth measures.
#rce#vulnerability#patch-available#ot
Vulnerability
CISA ICS
2026-10-06
Hitachi Energy REB500 products have open-source vulnerabilities allowing DoS attacks via crafted IEC 61850 messages.
Hitachi Energy REB500 versions 8.3.3.1 and prior are affected by CVE-2024-8176 and CVE-2025-59375, which exploit the libexpat library to cause denial of service or memory corruption. These vulnerabilities can be triggered by authenticated users with local access sending crafted IEC 61850 messages.
AFFECTEDHitachi Energy REB500
▸ DO Update REB500 to version 8.3.4.0 immediately.
#vulnerability#patch-available#ot
Vulnerability
CISA ICS
2026-10-06
Hitachi Energy Asset Suite versions 9.9.0 and prior have unauthenticated servlet access flaws risking confidentiality, integrity, and availability.
Hitachi Energy has identified unauthenticated servlet access vulnerabilities in Asset Suite versions 9.9.0 and prior, allowing configuration file uploads and information disclosure. These flaws can be exploited to compromise the confidentiality, integrity, and availability of the product.
AFFECTEDHitachi Energy Asset Suite
▸ DO Upgrade to Asset Suite 9.9.1 when available or disable the HTTPPublishAdapterTestServlet.
#vulnerability#patch-available#energy
Vulnerability
CISA ICS
2026-10-01
Monta monta.app charging stations have critical authentication flaws allowing unauthorized administrative control and DoS attacks.
Successful exploitation of CVE-2026-95102, CVE-2026-97363, CVE-2026-97212, and CVE-2026-93474 in Monta monta.app enables attackers to impersonate charging stations, escalate privileges, and disrupt energy infrastructure. The vulnerabilities stem from missing authentication, improper rate limiting, insufficient session expiration, and unprotected credentials.
AFFECTEDMonta monta.app
▸ DO Patch Monta monta.app charging stations immediately and monitor for unauthorized WebSocket connections.
#vulnerability#patch-available#ot#energy
Vulnerability
CISA ICS
2026-10-01
Meari IoT Cloud Platform OpenAPI Service has critical authorization flaws allowing unauthorized device manipulation and data access.
Successful exploitation of CVE-2026-101104 and CVE-2026-96613 in the Meari IoT Cloud Platform OpenAPI Service enables attackers to alter device configurations, trigger unauthorized behaviors, and access sensitive credentials and network data. Meari has not released a fix and did not respond to CISA coordination attempts.
AFFECTEDMeari IoT Cloud Platform OpenAPI Service
▸ DO Review and patch Meari IoT Cloud Platform OpenAPI Service deployments; monitor for unauthorized device configuration changes.
#vulnerability#patch-available#mitigations
Vulnerability
CISA ICS
2026-10-01
Johnson Controls EasyIO Neo controllers have a cleartext transmission flaw allowing interception of credentials and session data.
A vulnerability in Johnson Controls EasyIO Neo Series EC and CW Controllers allows attackers to intercept and read sensitive information, including credentials and session data, transmitted in cleartext. Affected versions include V3.3b62, V3.3b63, V3.3b24, and V3.3b25, impacting critical infrastructure sectors like commercial facilities and energy.
AFFECTEDJohnson Controls EasyIO Neo Series EC Controllers V3.3b62Johnson Controls EasyIO Neo Series EC Controllers V3.3b63Johnson Controls EasyIO Neo Series CW Controllers V3.3b24Johnson Controls EasyIO Neo Series CW Controllers V3.3b25
▸ DO Patch Johnson Controls EasyIO Neo controllers to versions that mitigate CVE-2026-64893 and review network configurations to ensure sensitive data is not transmitted in cleartext.
#vulnerability#cleartext-transmission#credential-theft#critical-infrastructure
Vulnerability
CISA ICS
2026-10-01
Johnson Controls EasyIO Neo Series EC and CW Controllers have a critical vulnerability allowing unauthorized access to sensitive information.
A vulnerability (CVE-2026-64892) in Johnson Controls EasyIO Neo Series EC and CW Controllers allows attackers to gain access to sensitive information, which could be used for further attacks. These programmable edge controllers are used in building automation for HVAC, lighting, and energy management.
AFFECTEDJohnson Controls EasyIO Neo Series EC Controllers V3.3b63Johnson Controls EasyIO Neo Series EC Controllers V3.3b62Johnson Controls EasyIO Neo Series CW Controllers V3.3b25Johnson Controls EasyIO Neo Series CW Controllers V3.3b24
▸ DO Patch Johnson Controls EasyIO Neo Series EC and CW Controllers to version V3.3b63 or higher for EC and V3.3b25 or higher for CW.
#vulnerability#patch-available#ot
Vulnerability
RCE
CISA ICS
2026-10-01
CISA Malcolm advisory details critical cross-site scripting and injection flaws in CISA Malcolm affecting energy, IT, and water sectors.
CISA Malcolm is vulnerable to multiple severe flaws including cross-site scripting, OS command injection, and path traversal. These vulnerabilities allow unauthenticated attackers to execute arbitrary scripts and redirect users, impacting critical infrastructure sectors like energy, IT, and water.
AFFECTEDCISA Malcolm
▸ DO Review and patch CISA Malcolm systems immediately, especially in energy, IT, and water sectors.
#rce#vulnerability#cross-site-scripting#injection#critical-infrastructure#patch-available
Vulnerability
RCE
CISA ICS
2026-10-01
Armatura One systems have critical vulnerabilities allowing unauthorized access, code execution, and physical access control compromise.
Armatura LLC Armatura One versions below 4.7.2 and 4.6.1 are affected by multiple critical vulnerabilities including deserialization of untrusted data, hard-coded cryptographic keys, and hard-coded credentials. Successful exploitation could allow attackers to gain unauthorized database access, execute arbitrary code with highest privileges, or control physical access-control systems.
AFFECTEDArmatura One
▸ DO Upgrade Armatura One to version 4.7.2 or 4.6.1 immediately and review network segmentation for embedded Apache ActiveMQ services.
#rce#vulnerability#patch-available#critical-infrastructure#deserialization#hard-coded-credentials
Vulnerability
CISA ICS
2026-10-01
ABB Protection and Control IED Manager PCM600 <=2.14 has privilege escalation and path traversal flaws exploitable by local attackers.
Successful exploitation of CVE-2026-15952 and CVE-2026-15953 in ABB PCM600 allows attackers to escalate privileges or overwrite files. The Scheduler Service runs under LocalSystem with overly permissive local user group memberships, enabling local attackers with valid credentials to gain control.
AFFECTEDABB Protection and Control IED Manager PCM600
▸ DO Patch ABB PCM600 to version >2.14 or apply ABB's recommended workaround immediately.
#vulnerability#patch-available#ot
Vulnerability
CISA ICS
2026-09-29
Viidure Dashcam Android App versions <=3.3.1.260403 have critical cloud storage misconfigurations and hard-coded credentials exposing user data and system files.
CISA reports that the Viidure Dashcam Android Application is affected by two vulnerabilities: a public-read cloud storage bucket exposing sensitive data and hard-coded credentials. Exploitation could allow attackers to access, modify, or delete critical system files, potentially compromising the entire platform. Viidure has not provided a fix and did not respond to CISA's coordination attempts.
AFFECTEDViidure Dashcam Android Application
▸ DO Update Viidure Dashcam Android Application to version >3.3.1.260403 or disable cloud storage access if no patch is available.
#vulnerability#data-exposure#mitigations
Vulnerability
RCE
CISA ICS
2026-09-29
VIVOTEK camera firmware has a critical remote code execution flaw allowing full system compromise.
A critical vulnerability in VIVOTEK camera firmware allows attackers to achieve remote command execution with root privileges, leading to full system compromise. Affected models include V Series, C Series, S Series, Dome, and others listed in the advisory.
AFFECTEDVIVOTEK Camera Firmware
▸ DO Patch all affected VIVOTEK camera firmware immediately and verify the update.
#rce#vulnerability#patch-available#iot
Vulnerability
RCE
CISA ICS
2026-09-29
Toptech TMS7 and TopHAT have critical vulnerabilities allowing unauthenticated data access and code execution.
Successful exploitation of these vulnerabilities could allow an attacker to access critical data or execute arbitrary code. Affected versions include TMS7 7.6.3 and TopHAT 7.6.3, impacting sectors like Energy, Chemical, and Transportation Systems.
AFFECTEDToptech TMS7TopHAT
▸ DO Patch Toptech TMS7 and TopHAT immediately to versions prior to 7.6.3 or apply vendor-provided mitigations.
#rce#vulnerability#patch-available#critical-infrastructure
Vulnerability
RCE
CISA ICS
2026-09-29
MikroTik RouterOS versions below 7.24 have a critical integer underflow flaw allowing unauthenticated remote code execution or denial of service.
A critical integer underflow vulnerability (CVE-2026-84411) in MikroTik RouterOS web management service allows unauthenticated attackers to execute arbitrary code as root or cause denial of service via a single crafted HTTP request. Affected versions are RouterOS <7.24, impacting communications and IT sectors worldwide.
AFFECTEDMikroTik RouterOS
▸ DO Update MikroTik RouterOS to version 7.23 or later immediately.
#rce#vulnerability#patch-available#critical#remote-code-execution
Vulnerability
RCE
CISA ICS
2026-09-29
Lantronix G520 Series Cellular Gateway devices have critical vulnerabilities allowing arbitrary code execution with root privileges.
Successful exploitation of CVE-2026-84409 and CVE-2026-91191 in Lantronix G520 Series Cellular Gateway devices allows attackers to replace software and execute arbitrary code with root privileges. The vulnerabilities stem from improper neutralization of input during web page generation and improper verification of cryptographic signatures.
AFFECTEDLantronix G520 Series Cellular Gateway
▸ DO Patch Lantronix G520 Series Cellular Gateway devices immediately to mitigate CVE-2026-84409 and CVE-2026-91191.
#rce#vulnerability#patch-available#ot
Vulnerability
CISA ICS
2026-09-29
Baicells Nova 430H eNodeBs are vulnerable to a DoS flaw that disrupts cellular signaling.
An unauthenticated device can send a malformed uplink message during connection setup to a Baicells Nova 430H eNodeB, causing a temporary service disruption. No fix is planned and Baicells has not engaged with CISA to mitigate this vulnerability.
AFFECTEDBaicells Nova 430H
▸ DO Patch affected Nova 430H eNodeBs or implement compensating controls to prevent malformed message injection.
#vulnerability#patch-available#ot
Vulnerability
RCE
CISA ICS
2026-09-29
Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 contains multiple critical vulnerabilities allowing full device compromise.
Successful exploitation of these vulnerabilities could allow an attacker to access sensitive information, access user accounts, execute OS-level commands, or take full control over the device. The affected firmware version is 3.3.2.4_build_2024-12-26.
AFFECTEDAnjvision YSSD-RTMP-H5
▸ DO Update Anjvision YSSD-RTMP-H5 firmware to a patched version immediately.
#rce#vulnerability#patch-available#critical-infrastructure
Vulnerability
RCE
CISA ICS
2026-09-24
Eufy Omni C20 and Omni X10 Pro devices below version 1.6.4 are vulnerable to critical command injection flaws allowing unauthenticated attackers to execute system commands.
Successful exploitation of CVE-2026-93289, CVE-2026-93290, and CVE-2026-93291 could allow an unauthenticated attacker to run system-level commands or execute arbitrary code during the pairing process. These vulnerabilities are rated CRITICAL (CVSS 9.4) and affect devices deployed worldwide.
AFFECTEDEufy Omni C20Eufy Omni X10 Pro
▸ DO Upgrade Eufy Omni C20 and Omni X10 Pro firmware to version 1.6.4 or later immediately.
#rce#vulnerability#patch-available#critical#iot
Vulnerability
CISA ICS
2026-09-24
Botslab G980H dashcams have multiple critical vulnerabilities allowing authentication bypass and unauthorized access.
Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication controls, gain unauthorized access to sensitive data, and modify device configuration. The affected devices are the G980H dash cam series 30010_QHG980HN5294SysFW+ and 58_QHG980HMCN5291SysFW+.
AFFECTEDBotslab G980H dashcams
▸ DO Patch affected Botslab G980H dashcams immediately or isolate them from the network.
#vulnerability#patch-available#dib-sector
Vulnerability
RCE
CISA ICS
2026-09-22
lwIP MQTT Client Application versions 2.0.1 to 2.2.1 have a critical out-of-bounds write flaw enabling full code execution.
A critical vulnerability (CVE-2026-87121) in the lwIP TCP/IP Stack MQTT Client Application allows attackers to achieve full code execution via an out-of-bounds write. Affected versions range from 2.0.1 to 2.2.1 and impact critical infrastructure sectors including chemical, energy, and water systems.
AFFECTEDlwIP MQTT Client Application
▸ DO Update lwIP MQTT Client Application to version >2.2.1 immediately using the official repository.
#rce#vulnerability#critical#patch-available#ot#ics-ot
Vulnerability
RCE
CISA ICS
2026-09-22
lwIP API versions 2.0.1 through 2.2.1 contain a double-free flaw that can crash systems or allow code execution.
A double-free vulnerability in lwIP (CVE-2026-91018) can cause system crashes, denial of service, memory corruption, or remote code execution. Affected versions range from API 2.0.1 to 2.2.1 and impact critical infrastructure sectors including chemical, communications, energy, and water systems.
AFFECTEDlwIP
▸ DO Update lwIP to commit f873b6295933e4149a2132adf3e9a2d2a676a5ec or a later patched version immediately.
#rce#vulnerability#patch-available#critical-infrastructure#double-free
Vulnerability
RCE
CISA ICS
2026-09-22
Siemens WTV676 and WTV776 devices have a DoS vulnerability that disables remote Web Access when forced into protection mode.
A denial-of-service vulnerability (CVE-2026-89207) allows unauthenticated attackers to force Siemens WTV676 and WTV776 devices into protection mode, disabling remote Web Access. Siemens has released patches for both products and recommends updating to the latest versions immediately.
AFFECTEDSiemens WTV676Siemens WTV776
▸ DO Update Siemens WTV676 and WTV776 Web Interfaces to V3.94 or V4.17 or later.
#rce#vulnerability#patch-available#ot
Vulnerability
CISA ICS
2026-09-22
Siemens Siveillance Control OIS web module allows arbitrary file uploads leading to root access.
A vulnerability in the Open Interface Services (OIS) web module of Siemens Siveillance Control and Siveillance Control Pro versions 3.x.y and 4.x.y allows attackers to upload arbitrary files, resulting in unauthorized root-level access. Siemens has released patches and recommends updating to the latest versions to mitigate this critical flaw.
AFFECTEDSiemens Siveillance Control Pro V3.0Siemens Siveillance Control Pro V4.0Siemens Siveillance Control V3.0Siemens Siveillance Control V4.0
▸ DO Apply Siemens patches and update Siveillance Control OIS to the latest versions immediately.
#vulnerability#patch-available#critical-infrastructure#root-access
Vulnerability
CISA ICS
2026-09-22
Siemens SIPLUS and SIMATIC products are vulnerable to the 'Copy Fail' vulnerability (CVE-2026-31431) and require immediate updates.
Multiple Siemens SIPLUS and SIMATIC products are affected by the 'Copy Fail' vulnerability, which could allow unauthorized access or manipulation of industrial control systems. Siemens has released new versions for several affected products and recommends updating to the latest versions immediately.
AFFECTEDSiemens SIPLUSSIMATIC AX Runtime Core Linux Common DebianSIMATIC CN 4100SIMATIC HMI MTP1000 Unified BasicSIMATIC HMI MTP1000 Unified Comfort PanelSIMATIC HMI MTP1200 Comfort Pro
▸ DO Update all affected Siemens SIPLUS and SIMATIC products to the latest versions and apply Siemens' recommended countermeasures for products where fixes are not yet available.
#vulnerability#patch-available#ot#ics-ot
Vulnerability
CISA ICS
2026-09-22
Siemens SIMOVE Fleetmanager and SIPLANT have a critical path traversal flaw allowing unauthenticated file reads.
A relative path traversal vulnerability (CVE-2026-67367) in Siemens SIMOVE Fleetmanager and SIPLANT allows unauthenticated attackers to read arbitrary files from the underlying OS. Siemens has released patched versions and recommends immediate updates to mitigate this critical risk.
AFFECTEDSiemens SIMOVE FleetmanagerSiemens SIPLANT
▸ DO Update all affected SIMOVE Fleetmanager and SIPLANT systems to the latest patched versions immediately.
#vulnerability#patch-available#critical#ics-ot
Vulnerability
RCE
CISA ICS
2026-09-22
Siemens Industrial Edge Management has an authentication bypass allowing unauthenticated remote attackers to reset user credentials without email verification.
A critical vulnerability (CVE-2026-18963) in Siemens Industrial Edge Management enables full account takeover by bypassing the email verification step in the password reset flow. Siemens has released patches and recommends immediate updates to affected versions across all product lines.
AFFECTEDSiemens Industrial Edge Management CloudSiemens Industrial Edge Management Pro V1Siemens Industrial Edge Management Pro V2Siemens Industrial Edge Management Virtual
▸ DO Update Siemens Industrial Edge Management to the latest patched versions immediately.
#rce#vulnerability#patch-available#critical#account-takeover
Vulnerability
RCE
CISA ICS
2026-09-22
A client code execution flaw in Siemens Desigo CC allows arbitrary code execution via malicious graphics documents.
Siemens Desigo CC family versions V6 and V7 are vulnerable to CVE-2026-34223, which permits code injection through user-defined graphics with embedded scripts. Exploitation can compromise client operating systems and enable lateral movement, impacting critical manufacturing and commercial facilities.
AFFECTEDSiemens Desigo CC family V6Siemens Desigo CC family V7
▸ DO Patch Siemens Desigo CC family V6 and V7 immediately and restrict opening untrusted graphics documents.
#rce#vulnerability#patch-available#critical-infrastructure#code-injection
Vulnerability
CISA ICS
2026-09-22
OpenPLC Runtime v3 has a critical cross-site scripting flaw allowing attackers to hijack sessions and control PLCs.
Autonomy Logic OpenPLC Runtime v3 is vulnerable to CVE-2026-88020, a cross-site scripting flaw that lets attackers hijack session cookies and issue state-changing requests to control programmable logic controllers and physical processes. The vendor recommends upgrading to OpenPLC v4, as v3 is end-of-life and no longer receives security updates.
AFFECTEDOpenPLC Runtime v3
▸ DO Upgrade to OpenPLC v4 immediately or isolate affected systems from the network.
#vulnerability#patch-available#ot#critical-infrastructure
Vulnerability
CISA ICS
2026-09-17
Schneider Electric PowerChute Serial Shutdown has an authentication bypass flaw allowing unauthorized access.
Schneider Electric identified a vulnerability in PowerChute Serial Shutdown where improper restriction of excessive authentication attempts could allow attackers to gain unauthorized access. This affects versions 1.5 and 1.6 and could disrupt operations or expose system data.
AFFECTEDSchneider Electric PowerChute Serial Shutdown
▸ DO Patch Schneider Electric PowerChute Serial Shutdown to version 1.7 or later immediately.
#vulnerability#patch-available#authentication-bypass