![\"Adversary](\"https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/Figure%201%20FSB%20Center%2016%20activity%20and%20recommended%20mitigation%20actions.png?itok=oYxdyna4\")
\n\n\n\nSuccessful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition.
\nThe following versions of Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 8.6 | \nRockwell Automation | \nRockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix | \nBuffer Copy without Checking Size of Input ('Classic Buffer Overflow') | \n
A denial-of-service issue exists in 5370/5570 controllers. This vulnerability could potentially allow a remote user to load an invalid project, causing the device to enter a major non-recoverable fault (MNRF).
\n\nVendor fix
Rockwell Automation recommend updating to the following: CompactLogix 5370: Update to V35.016, V36.011 and later
Vendor fix
Compact GuardLogix 5370: Update to V35.016, V36.011 and later
Vendor fix
ControlLogix 5570: Update to V35.016, V36.011 and later
Vendor fix
GuardLogix 5570: Update to V35.016, V36.011 and later
Vendor fix
CompactLogix 5380: Update to V34.014, V35.013, V36.011 and later
Vendor fix
Compact GuardLogix 5380: Update to V34.014, V35.013, V36.011 and later
Vendor fix
CompactLogix 5480: Update to V34.014, V35.013, V36.011 and later
Vendor fix
ControlLogix 5580: Update to V34.014, V35.013, V36.011 and later
Vendor fix
GuardLogix 5580: Update to V34.014, V35.013, V36.011 and later
Vendor fix
CompactLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
Compact GuardLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
CompactLogix 5480 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
ControlLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
GuardLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.6 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H | \n
| 4.0 | \n9.2 | \nCRITICAL | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H | \n
A denial-of-service issue exists in 5380/5480/5580 controllers. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major nonrecoverable fault (MNRF).
\n\nVendor fix
Rockwell Automation recommend updating to the following: CompactLogix 5370: Update to V35.016, V36.011 and later
Vendor fix
Compact GuardLogix 5370: Update to V35.016, V36.011 and later
Vendor fix
ControlLogix 5570: Update to V35.016, V36.011 and later
Vendor fix
GuardLogix 5570: Update to V35.016, V36.011 and later
Vendor fix
CompactLogix 5380: Update to V34.014, V35.013, V36.011 and later
Vendor fix
Compact GuardLogix 5380: Update to V34.014, V35.013, V36.011 and later
Vendor fix
CompactLogix 5480: Update to V34.014, V35.013, V36.011 and later
Vendor fix
ControlLogix 5580: Update to V34.014, V35.013, V36.011 and later
Vendor fix
GuardLogix 5580: Update to V34.014, V35.013, V36.011 and later
Vendor fix
CompactLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
Compact GuardLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
CompactLogix 5480 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
ControlLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
GuardLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.6 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H | \n
| 4.0 | \n9.2 | \nCRITICAL | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H | \n
A denial-of-service issue exists in 5380/5480/5580 controllers boot firmware lower than version 1.072. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault (MNRF).
\n\nVendor fix
Rockwell Automation recommend updating to the following: CompactLogix 5370: Update to V35.016, V36.011 and later
Vendor fix
Compact GuardLogix 5370: Update to V35.016, V36.011 and later
Vendor fix
ControlLogix 5570: Update to V35.016, V36.011 and later
Vendor fix
GuardLogix 5570: Update to V35.016, V36.011 and later
Vendor fix
CompactLogix 5380: Update to V34.014, V35.013, V36.011 and later
Vendor fix
Compact GuardLogix 5380: Update to V34.014, V35.013, V36.011 and later
Vendor fix
CompactLogix 5480: Update to V34.014, V35.013, V36.011 and later
Vendor fix
ControlLogix 5580: Update to V34.014, V35.013, V36.011 and later
Vendor fix
GuardLogix 5580: Update to V34.014, V35.013, V36.011 and later
Vendor fix
CompactLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
Compact GuardLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
CompactLogix 5480 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
ControlLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
GuardLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.6 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H | \n
| 4.0 | \n9.2 | \nCRITICAL | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-16 | \n1 | \nInitial Publication | \n
Multiple SICAM 8 products are affected by multiple vulnerabilities that could lead to denial of service, namely: - SICAM A8000 Device firmware - CPCI85 for CP-8031/CP-8050 - SICORE for CP-8010/CP-8012 - SICAM EGS Device firmware - CPCI85 - SICAM S8000 - SICORE Siemens has released new versions for the affected products and recommends to update to the latest versions.
\nThe following versions of Siemens SICAM 8 are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.2 | \nSiemens | \nSiemens SICAM 8 | \nActive Debug Code, Initialization of a Resource with an Insecure Default, Unverified Password Change | \n
The affected application includes a debugging interface that is accessible through HTTP endpoints. This could allow an authenticated attacker to disrupt the system by crashing the web process causing denial of service conditions.
\n\nVendor fix
Update to V26.20 or later version The firmware CPCI85 V26.20 is present within \u201cCP-8031/CP-8050 Package\u201d V26.20 https://support.industry.siemens.com/cs/ww/en/view/109804985/ and also within \u201cSICAM EGS Package\u201d V26.20 https://support.industry.siemens.com/cs/document/109972536/
Vendor fix
Update to V26.20.0 or later version The firmware SICORE V26.20.0 is present within \u201cCP-8010/CP-8012 Package\u201d V26.20 https://support.industry.siemens.com/cs/ww/en/view/109972894/ and also within \u201cSICAM S8000 Package\u201d V26.20 https://support.industry.siemens.com/cs/document/109818240
Relevant CWE: CWE-489 Active Debug Code
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
The affected application contains a vulnerability in its firmware update mechanism's signature validation process. This could allow an attacker to install malicious firmware, leading to persistent code execution and system compromise.
\n\nVendor fix
Update to V26.20 or later version The firmware CPCI85 V26.20 is present within \u201cCP-8031/CP-8050 Package\u201d V26.20 https://support.industry.siemens.com/cs/ww/en/view/109804985/ and also within \u201cSICAM EGS Package\u201d V26.20 https://support.industry.siemens.com/cs/document/109972536/
Vendor fix
Update to V26.20.0 or later version The firmware SICORE V26.20.0 is present within \u201cCP-8010/CP-8012 Package\u201d V26.20 https://support.industry.siemens.com/cs/ww/en/view/109972894/ and also within \u201cSICAM S8000 Package\u201d V26.20 https://support.industry.siemens.com/cs/document/109818240
Relevant CWE: CWE-489 Active Debug Code
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.7 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | \n
The affected application ships with a default configuration that disables all OPC UA security mechanisms. This could allow an attacker to gain unauthorized access and control over critical system functions.
\n\nVendor fix
Update to V26.20 or later version The firmware CPCI85 V26.20 is present within \u201cCP-8031/CP-8050 Package\u201d V26.20 https://support.industry.siemens.com/cs/ww/en/view/109804985/ and also within \u201cSICAM EGS Package\u201d V26.20 https://support.industry.siemens.com/cs/document/109972536/
Vendor fix
Update to V26.20.0 or later version The firmware SICORE V26.20.0 is present within \u201cCP-8010/CP-8012 Package\u201d V26.20 https://support.industry.siemens.com/cs/ww/en/view/109972894/ and also within \u201cSICAM S8000 Package\u201d V26.20 https://support.industry.siemens.com/cs/document/109818240
Relevant CWE: CWE-1188 Initialization of a Resource with an Insecure Default
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n4.8 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N | \n
The affected application contains insufficient validation of authentication credentials when processing administrative account modifications through the web API. This could allow an authenticated attacker to bypass security controls and gain unauthorized elevated privileges.
\n\nVendor fix
Update to V26.20 or later version The firmware CPCI85 V26.20 is present within \u201cCP-8031/CP-8050 Package\u201d V26.20 https://support.industry.siemens.com/cs/ww/en/view/109804985/ and also within \u201cSICAM EGS Package\u201d V26.20 https://support.industry.siemens.com/cs/document/109972536/
Vendor fix
Update to V26.20.0 or later version The firmware SICORE V26.20.0 is present within \u201cCP-8010/CP-8012 Package\u201d V26.20 https://support.industry.siemens.com/cs/ww/en/view/109972894/ and also within \u201cSICAM S8000 Package\u201d V26.20 https://support.industry.siemens.com/cs/document/109818240
Relevant CWE: CWE-620 Unverified Password Change
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.2 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | \n
Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid's reliability can thus be minimized by virtue of the grid design. Siemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. As a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment. Recommended security guidelines can be found at: https://www.siemens.com/gridsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact Siemens: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability. Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens SSA-229470 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-09 | \n1 | \nPublication Date | \n
| 2026-07-16 | \n2 | \nInitial CISA Republication of Siemens SSA-229470 advisory | \n
Successful exploitation of this vulnerability allows an authenticated attacker to escalate privileges and access spaces outside their assigned partition, within the same Salto ProAccess Space installation or system. Exploitation requires valid authenticated operator credentials and the partition feature to be enabled; installations without partitioning are not affected.
\nThe following versions of SALTO ProAccess Space are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 6.5 | \nSALTO | \nSALTO ProAccess Space | \nAuthorization Bypass Through User-Controlled Key | \n
SALTO ProAccess Space software using the tenancy feature / logical partition is vulnerable to a privilege escalation attack that could allow an authorized attacker to access any space managed by the affected product.
\n\nMitigation
Users of SALTO ProAccess using the tenancy feature should upgrade to version 6.13.
Vendor fix
To further enhance security after applying the update: 1. Operate ProAccess Space on a protected internal network and avoid exposing it directly to the Internet. 2. Restrict operator-level accounts to the minimum required and apply least-privilege principles. 3. If feasible, disable the partitioning feature and operate under a single partition. 4. When strong tenant separation is required, consider running separate Space instances (isolated environments) rather than relying solely on logical partitioning.
Relevant CWE: CWE-639 Authorization Bypass Through User-Controlled Key
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N | \n
| 4.0 | \n7.1 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-16 | \n1 | \nInitial Publication | \n
Successful exploitation of this vulnerability could allow an authenticated attacker to inject malicious scripts on the server.
\nThe following versions of Rockwell Automation FactoryTalk DataMosaix are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 6.1 | \nRockwell Automation | \nRockwell Automation FactoryTalk DataMosaix | \nImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | \n
A Stored Cross-Site Scripting security issue exists within FactoryTalk DataMosaix Private Cloud. The vulnerability stems from improper neutralization of user-supplied input within the Workflows configuration. An authenticated attacker with high privileges can inject malicious scripts that are permanently stored on the server. This vulnerability can result in the execution of malicious JavaScript when other users access the affected page, potentially allowing for account takeover, credential theft, or redirection to a malicious website.
\n\nVendor fix
Rockwell Automation recommends users to upgrade to the following: DataMosaix Private Cloud versions 8.03 or later.
Mitigation
Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight).
https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight
Mitigation
For more information, see Rockwell Automation Security Advisory SD1787 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1787.html).
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1787.html
Relevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.1 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N | \n
| 4.0 | \n8.4 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-16 | \n1 | \nInitial Republication of Rockwell Automation Security Advisory SD1787 | \n
Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition.
\nThe following versions of Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.5 | \nRockwell Automation | \nRockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT | \nImproper Validation of Integrity Check Value | \n
A denial-of-service security issue exists across all the 1756-EN2, EN3, and ENBT communication module due to improper validation of CIP Implicit Connection packets. An attacker on the network can exploit this by sending crafted packets to continuously disrupt device connections, though device connections will recover immediately after.
\n\nVendor fix
Rockwell Automation recommends users take the following actions: 1756-EN3: Update to V12.002
Vendor fix
1756-EN2: Update to V12.002
Vendor fix
1756-ENBT: Product is discontinued, fix is unavailable
Relevant CWE: CWE-354 Improper Validation of Integrity Check Value
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-16 | \n1 | \nInitial Publication | \n
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
", "summary_is_html": true, "first_seen": "Thu, 16 Jul 26 12:00:00 +0000", "last_updated": "Thu, 16 Jul 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-01", "title": "Rockwell Automation Arena", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-01", "summary": "\nSuccessful exploitation these vulnerabilities could allow an attacker to execute arbitrary code in the context of the current process.
\nThe following versions of Rockwell Automation Arena are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.8 | \nRockwell Automation | \nRockwell Automation Arena | \nOut-of-bounds Write | \n
A security issue exists within Arena Simulation due to a memory corruption vulnerability in the model.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.
\n\nMitigation
Rockwell Automation recommends users to update to V17.00.01
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
| 4.0 | \n7 | \nHIGH | \nCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
A security issue exists within Arena Simulation due to a memory corruption vulnerability in the expmt.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.
\n\nMitigation
Rockwell Automation recommends users to update to V17.00.01
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
| 4.0 | \n7 | \nHIGH | \nCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
A security issue exists within Arena Simulation due to a memory corruption vulnerability in the linker.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.
\n\nMitigation
Rockwell Automation recommends users to update to V17.00.01
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
| 4.0 | \n7 | \nHIGH | \nCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
A security issue exists within Arena Simulation due to a memory corruption vulnerability in the siman.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.
\n\nMitigation
Rockwell Automation recommends users to update to V17.00.01
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
| 4.0 | \n7 | \nHIGH | \nCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-16 | \n1 | \nInitial Publication | \n
Successful exploitation of these vulnerabilities could allow an attacker with local or physical access to cause memory corruption, unintended information disclosure, application instability, or a denial-of-service condition in the affected product.
\nThe following versions of AutomationDirect Productivity Suite are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7 | \nAutomationDirect | \nAutomationDirect Productivity Suite | \nOut-of-bounds Write, Out-of-bounds Read, Divide By Zero | \n
An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability.
\n\nMitigation
AutomationDirect recommends that users update Productivity suite to v4.7.0.47 and above https://www.automationdirect.com/support/software-downloads.
https://www.automationdirect.com/support/software-downloads
Mitigation
If the update cannot be applied right away, the following compensating controls are recommended until the upgrade can be performed.
Mitigation
Disconnect the engineering workstation from external networks (e.g., the internet or corporate LAN) to reduce exposure.
Mitigation
Use only trusted, dedicated internal networks or air-gapped systems for device communication.
Mitigation
Restrict both physical and logical access to authorized personnel only.
Mitigation
Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software.
Mitigation
Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts.
Mitigation
Enable and regularly review system logs to detect suspicious or unauthorized activity.
Mitigation
Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident.
Mitigation
Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly.
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7 | \nHIGH | \nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
| 4.0 | \n7.3 | \nHIGH | \nCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability.
\n\nMitigation
AutomationDirect recommends that users update Productivity suite to v4.7.0.47 and above https://www.automationdirect.com/support/software-downloads.
https://www.automationdirect.com/support/software-downloads
Mitigation
If the update cannot be applied right away, the following compensating controls are recommended until the upgrade can be performed.
Mitigation
Disconnect the engineering workstation from external networks (e.g., the internet or corporate LAN) to reduce exposure.
Mitigation
Use only trusted, dedicated internal networks or air-gapped systems for device communication.
Mitigation
Restrict both physical and logical access to authorized personnel only.
Mitigation
Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software.
Mitigation
Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts.
Mitigation
Enable and regularly review system logs to detect suspicious or unauthorized activity.
Mitigation
Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident.
Mitigation
Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly.
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7 | \nHIGH | \nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
| 4.0 | \n7.3 | \nHIGH | \nCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This can lead to exposing sensitive information or causing the affected product to become unstable or unavailable.
\n\nMitigation
AutomationDirect recommends that users update Productivity suite to v4.7.0.47 and above https://www.automationdirect.com/support/software-downloads.
https://www.automationdirect.com/support/software-downloads
Mitigation
If the update cannot be applied right away, the following compensating controls are recommended until the upgrade can be performed.
Mitigation
Disconnect the engineering workstation from external networks (e.g., the internet or corporate LAN) to reduce exposure.
Mitigation
Use only trusted, dedicated internal networks or air-gapped systems for device communication.
Mitigation
Restrict both physical and logical access to authorized personnel only.
Mitigation
Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software.
Mitigation
Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts.
Mitigation
Enable and regularly review system logs to detect suspicious or unauthorized activity.
Mitigation
Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident.
Mitigation
Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly.
Relevant CWE: CWE-125 Out-of-bounds Read
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.1 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H | \n
| 4.0 | \n6.9 | \nMEDIUM | \nCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N | \n
An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This could lead to limited information disclosure or disruption of the affected product.
\n\nMitigation
AutomationDirect recommends that users update Productivity suite to v4.7.0.47 and above https://www.automationdirect.com/support/software-downloads.
https://www.automationdirect.com/support/software-downloads
Mitigation
If the update cannot be applied right away, the following compensating controls are recommended until the upgrade can be performed.
Mitigation
Disconnect the engineering workstation from external networks (e.g., the internet or corporate LAN) to reduce exposure.
Mitigation
Use only trusted, dedicated internal networks or air-gapped systems for device communication.
Mitigation
Restrict both physical and logical access to authorized personnel only.
Mitigation
Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software.
Mitigation
Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts.
Mitigation
Enable and regularly review system logs to detect suspicious or unauthorized activity.
Mitigation
Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident.
Mitigation
Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly.
Relevant CWE: CWE-125 Out-of-bounds Read
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.1 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H | \n
| 4.0 | \n6.9 | \nMEDIUM | \nCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N | \n
An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB device. This can lead to a system crash or disclosure of kernel memory.
\n\nMitigation
AutomationDirect recommends that users update Productivity suite to v4.7.0.47 and above https://www.automationdirect.com/support/software-downloads.
https://www.automationdirect.com/support/software-downloads
Mitigation
If the update cannot be applied right away, the following compensating controls are recommended until the upgrade can be performed.
Mitigation
Disconnect the engineering workstation from external networks (e.g., the internet or corporate LAN) to reduce exposure.
Mitigation
Use only trusted, dedicated internal networks or air-gapped systems for device communication.
Mitigation
Restrict both physical and logical access to authorized personnel only.
Mitigation
Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software.
Mitigation
Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts.
Mitigation
Enable and regularly review system logs to detect suspicious or unauthorized activity.
Mitigation
Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident.
Mitigation
Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly.
Relevant CWE: CWE-125 Out-of-bounds Read
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.9 | \nMEDIUM | \nCVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H | \n
| 4.0 | \n5.2 | \nMEDIUM | \nCVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N | \n
A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a division by zero leading to a system crash.
\n\nMitigation
AutomationDirect recommends that users update Productivity suite to v4.7.0.47 and above https://www.automationdirect.com/support/software-downloads.
https://www.automationdirect.com/support/software-downloads
Mitigation
If the update cannot be applied right away, the following compensating controls are recommended until the upgrade can be performed.
Mitigation
Disconnect the engineering workstation from external networks (e.g., the internet or corporate LAN) to reduce exposure.
Mitigation
Use only trusted, dedicated internal networks or air-gapped systems for device communication.
Mitigation
Restrict both physical and logical access to authorized personnel only.
Mitigation
Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software.
Mitigation
Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts.
Mitigation
Enable and regularly review system logs to detect suspicious or unauthorized activity.
Mitigation
Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident.
Mitigation
Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly.
Relevant CWE: CWE-369 Divide By Zero
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.5 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
| 4.0 | \n6.8 | \nMEDIUM | \nCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-16 | \n1 | \nInitial Publication | \n
Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition on the affected product.
\nThe following versions of Rockwell Automation Flex 5000 Adapter are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.5 | \nRockwell Automation | \nRockwell Automation Flex 5000 Adapter | \nDouble Free | \n
A denial-of-service security issue exists in the affected products. The security issue stems from improper handling of exceptional conditions when processing crafted CIP packets sent to the adapter. A power cycle is required to recover the module and associated I/O.
\n\nVendor fix
Rockwell Automation recommends users to upgrade to the following: Flex 5000 Adapter version 6.012.
Mitigation
Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight).
https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight
Mitigation
For more information, see Rockwell Automation Security Advisory SD1789 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1789.html).
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1789.html
Relevant CWE: CWE-415 Double Free
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-16 | \n1 | \nInitial Republication of Rockwell Automation Security Advisory SD1789 | \n
Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition.
\nThe following versions of NASA Core Flight System (cFS) Health & Safety (HS) Application are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.5 | \nNASA | \nNASA Core Flight System (cFS) Health & Safety (HS) Application | \nNULL Pointer Dereference | \n
A vulnerability exists in the Health & Safety (HS) application of NASA's Core Flight System (cFS). The flaw allows the application to crash via segmentation fault when processing a routine Housekeeping Telemetry request, leading to denial of service.
\n\nMitigation
NASA recommends users update to v7.0.1 (https://github.com/nasa/HS/releases/tag/v7.0.1)
https://github.com/nasa/HS/releases/tag/v7.0.1
Relevant CWE: CWE-476 NULL Pointer Dereference
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
| 4.0 | \n8.2 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-16 | \n1 | \nInitial Publication | \n
Developed by CISA, the National Security Agency (NSA) and international partners, this joint guidance contains best practices for software manufacturers and online service providers to design and implement a coordinated vulnerability disclosure (CVD) program for working with external security researchers that includes a clear vulnerability disclosure policy (VDP) and process for triaging, remediating and assigning Common Vulnerabilities and Exposures (CVE) identifiers to reported vulnerabilities. The guidance also provides considerations for leveraging third-party intermediaries, like CISA or other national computer security incident response teams, to substitute or supplement a CVD program. By implementing a robust CVD program aligned with this guidance, organizations can work transparently and collaboratively with security researchers to remediate vulnerabilities, build constructive relationships, enhance product security while improving vulnerability management processes, and demonstrate their dedication to protecting customers.
", "summary_is_html": true, "first_seen": "Wed, 15 Jul 26 12:00:00 +0000", "last_updated": "Wed, 15 Jul 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/alerts/2026/07/15/cisa-adds-two-known-exploited-vulnerabilities-catalog", "title": "CISA Adds Two Known Exploited Vulnerabilities to Catalog", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/alerts/2026/07/15/cisa-adds-two-known-exploited-vulnerabilities-catalog", "summary": "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
", "summary_is_html": true, "first_seen": "Wed, 15 Jul 26 12:00:00 +0000", "last_updated": "Wed, 15 Jul 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-195-01", "title": "ABB Advant Master Online Builder", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-195-01", "summary": "\nABB became aware of vulnerability in the products versions listed as affected in the advisory, where an incorrect version of Online Builder (ONB) was included in the media. An update is available that resolves the vulnerability, see details in Recommended immediate actions.
\nThe following versions of ABB Advant Master Online Builder are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 4.4 | \nABB | \nABB Advant Master Online Builder | \nUncontrolled Search Path Element | \n
The application improperly handles the search path for loading DLL\u00b4s, potentially allowing unauthorized libraries from untrusted directories. An attacker who obtains the necessary access could exploit the vulnerability leading to unauthorized code execution and compromising system integrity.
\n\nVendor fix
ABB has investigated the vulnerability and remediated it in the newly released versions. The vulnerability has been resolved in the product versions listed as fixed in the advisory. - Version 6.1.1-2 does not contain this vulnerability and therefore no update is required. The vulnerability was again introduced in 6.1.1-3 when an older ONB version was included in the release media. - Version 6.1.1-4 do not contain this vulnerability but present version 6.1.1-3 by 800xA System Installer and System Configuration Console (SCC). Version 6.1.1-4 is therefore withdrawn. - Version 6.2.0-2 do not contain this vulnerability but present version 6.2.0-1 by 800xA System Installer and System Configuration Console (SCC). Version 6.2.0-2 is therefore withdrawn. ABB recommends that customers apply the update at their earliest convenience. - Control Builder A: It is recommended to update Control Builder A to version 1.4/5 or later. - 800xA for Advant Master: - Versions 6.0.3-1 and earlier, - Versions 6.1.1-1 and earlier, - Versions 6.1.1-2, 6.1.1-3, and 6.1.1-4 should be updated to version 6.1.1-5 or later. - 800xA for Advant Master: - Versions 6.2.0-1 and 6.2.0-2 should be updated to version 6.2.0-3 or later.
Mitigation
Since it is required that the attacker has access to the system, it is important that all users that have access to the system are managed as recommended by ABB guidelines. - Allow only authorized users to log on to the system and enforce strong passwords that are changed regularly. - Restrict temporary connection of portable computers, USB memory devices and other removable data carriers. Computers that can be physically accessed by regular users should have ports for removable data carriers disabled or at least managed to only allow intended device types. For more information on recommended practices, see [1].
Workaround
The recommendation is to upgrade to a version where the vulnerability is corrected. If an upgrade Is not possible and a workaround is needed, contact ABB Support.
Relevant CWE: CWE-427 Uncontrolled Search Path Element
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n4.4 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N | \n
The information in this document is subject to change without notice, and should not be construed as a commitment by ABB. ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.
\nWhat is the scope of vulnerability? - An attacker who successfully exploited this vulnerability could insert and run arbitrary code in an affected system node. What causes the vulnerability? - The vulnerability is caused by not having restricted permission on an application directory where DLL files are stored. What is Advant Master Online Builder? - Online Builder is part of Control Builder A, being a set of applications for configuration and programming of Advant Master controllers. Online Builder is also part of 800xA for Advant Master, an extension package to System 800xA connecting to Advant Master controllers. What might an attacker use the vulnerability to do? - An attacker who successfully exploited this vulnerability can run arbitrary code in an affected node. How could an attacker exploit the vulnerability? - An attacker who obtains the necessary access could exploit vulnerability by placing malicious DLL\u00b4s in the unrestricted application directory, leading to unauthorized code execution and compromising system integrity. Could the vulnerability be exploited remotely? - No, to exploit this vulnerability an attacker would need to have physical access to an affected system node. Can functional safety be affected by an exploit of this vulnerability? - No. What does the update do? - The update of the Online Builder (ONB) resolves the vulnerability by adding restrictions to the application folder, requiring authentication. When this security advisory was issued, had this vulnerability been publicly disclosed? - No, ABB identified this vulnerability through its internal security assessment and verification processes. When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited? - No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of ABB PSIRT 7PAA020047 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact ABB PSIRT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-06-23 | \n1 | \nInitial version. | \n
| 2026-07-14 | \n2 | \nInitial CISA Republication of ABB PSIRT 7PAA020047 advisory | \n
Successful exploitation of this vulnerability could allow an attacker to read or delete files, stop tasks, modify memory, and change I/O states, potentially impacting the confidentiality, integrity, and availability of the device.
\nThe following versions of Rockwell Automation 1715-AENTR EtherNet/IP Adapter are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 10 | \nRockwell Automation | \nRockwell Automation 1715-AENTR EtherNet/IP Adapter | \nMissing Authentication for Critical Function | \n
A security issue exists within the 1715-AENTR EtherNet/IP Adapter. The affected product exposes a network-accessible debug port that does not enforce proper privilege controls, allowing unauthenticated remote access to intrusive command-line interface (CLI) commands. If exploited, a threat actor could read or delete files, stop tasks, modify memory, and change I/O states, potentially impacting the confidentiality, integrity, and availability of the device.
\n\nVendor fix
Rockwell Automation recommends that users update to 1715-AENTR EtherNet/IP Adapter version 3.011 and later.
Mitigation
Rockwell Automation recommends users of the affected software who are not able to upgrade to one of the corrected versions should use their security best practices.
https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight
Mitigation
For more information, see the Rockwell Automation security advisory SD1785
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1785.html
Mitigation
If you have any questions regarding this security issue and how to mitigate it,contact Rockwell Automation for help.
https://www.rockwellautomation.com/en-us/company/about-us/contact-us.html
Relevant CWE: CWE-306 Missing Authentication for Critical Function
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n10 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | \n
| 4.0 | \n10 | \nCRITICAL | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-14 | \n1 | \nInitial Republication of Rockwell Automation security advisory SD1785. | \n
ABB is aware of public reports of a vulnerability CVE\u20112026\u201131431 (Copy Fail) in the product versions listed as affected in the advisory. An update is available that resolves a publicly reported vulnerability. CVE\u20112026\u201131431 (Copy Fail) is a Linux kernel vulnerability that may allow a locally authenticated user or compromised container workload to gain elevated (root) privileges on affected systems. Once root access is obtained, the attacker can effectively gain complete control of the system
\nThe following versions of ABB Ability Edgenius are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.8 | \nABB | \nABB Ability Edgenius | \nIncorrect Resource Transfer Between Spheres | \n
CVE\u20112026\u201131431 (Copy Fail) is a Linux kernel vulnerability that may allow a locally authenticated user or compromised container workload to gain elevated (root) privileges on affected systems. The issue originates in the Linux kernel\u2019s cryptographic subsystem and impacts kernels used by most major Linux distributions released since 2017. Successful exploitation requires local code execution, however, in shared, containerized, or multi\u2011tenant environments this may increase the security risk
\n\nVendor fix
The problem is corrected in the following product versions: - Edgenius 3.2.4.1 ABB recommends that customers apply the update at earliest convenience.
Mitigation
Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. Refer to section General security recommendations for further advise on how to keep your system secure. Recommended mitigation factors - Limit access to ssh or cockpit - By default, no additional lower privilege users are present on Edgenius installations
Relevant CWE: CWE-669 Incorrect Resource Transfer Between Spheres
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
The information in this document is subject to change without notice, and should not be construed as a commitment by ABB. ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.
\nWhat causes the vulnerability? - A flaw was found in the Linux kernel's algif_aead cryptographic algorithm interface. An incorrect 'in-place operation' was introduced, where the source and destination data mappings were different. This could lead to unexpected behavior or data integrity issues during cryptographic operations, potentially impacting the reliability of encrypted communications. What is Edgenius? - ABB Ability\u2122 Edgenius is an edge computing platform that - Connects to control systems, devices, and equipment - Collects and contextualizes operational data - Hosts applications that deliver real-time insights and AI-driven recommendations What might an attacker use the vulnerability to do? - Successful exploitation could enable a local user attacker to gain administrative control of the system node, execute arbitrary code, or cause the node to become unavailable. How could an attacker exploit the vulnerability? - An attacker could exploit this vulnerability after obtaining local access to the system. By invoking the Linux kernel\u2019s affected cryptographic interface (algif_aead), the attacker can trigger incorrect memory handling in the kernel. This allows the attacker to escalate privileges from a normal user to full administrative (root) access on the affected system node Could the vulnerability be exploited remotely? - No, to exploit this vulnerability an attacker would need to have local access (physical access or through valid SSH credentials) to an affected system node. What does the update do? - The update resolves the issue by incorporating the security update of the Linux kernel. When this security advisory was issued, had this vulnerability been publicly disclosed? - Yes, this vulnerability has been publicly disclosed. When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited? - No, ABB had not received any information indicating that this vulnerability had been exploited for Edgenius when this security advisory was originally issued.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of ABB PSIRT 7PAA024620 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact ABB PSIRT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-06-25 | \n1 | \nInitial version. | \n
| 2026-07-14 | \n2 | \nInitial CISA Republication of ABB PSIRT 7PAA024620 advisory | \n
Update July 16, 2026:
\nCISA has updated this Alert to reflect the addition of CVE-2026-58644 to its Known Exploited Vulnerabilities (KEV) Catalog on July 16, 2026.
\nCISA is aware of active exploitation of vulnerabilities CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644, enabling cyber threat actors to gain unauthorized access to on-premises SharePoint Server instances. These vulnerabilities affect all supported on-premises SharePoint Server versions (Subscription Edition, 2019, and 2016) and involve establishing remote code execution (RCE) and post-exploitation activities, such as stealing Internet Information Services (IIS) machine keys and performing deserialization techniques, to gain persistence and deploy malware. Organizations should monitor affected SharePoint Servers closely for any signs of exploitation or unusual activity.
\nAdditionally, the following newly disclosed CVE is not yet known to have been exploited, but Microsoft has identified it as posing a potential risk if left unpatched:
\nCISA urges organizations to detect and remediate a potential compromise by implementing the following recommendations:
\nExploit:Script/SuspSignoutReqBody.A \u2013 request body scanning; SharePoint Server Subscription only; Microsoft has blocked observed attempts.Exploit:Script/ToolPaneAuthBypass.A \u2013 request header scanning; SharePoint Server 2016, 2019, and Subscription Edition.Exploit:Script/ToolPaneAuthBypass.C \u2013 RCE coverage; SharePoint Server 2016, 2019, and Subscription Edition.Backdoor:MSIL/LeakFang.A!dha \u2013 post-exploitation activity alert involving IIS-protected secrets.In addition, CISA recommends that organizations implement the following SharePoint Server hardening measures:
\nWeb.config settings.CISA urges users and administrators to review the Alert UPDATE: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilities and apply necessary updates.
\nCISA added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2026-32201 on April 14, 2026; CVE-2026-45659 on July 1, 2026; CVE-2026-56164 on July 14, 2026; and CVE-2026-58644 on July 16, 2026.
\nNote: CISA may update this Alert to reflect new guidance issued by CISA or other parties.
\nOrganizations should report incidents or anomalous activity to CISA via CISA\u2019s 24/7 Operations Center at contact@cisa.dhs.gov or 1-844-Say-CISA (1-844-729-2472).
\nThe information in this report is being provided \u201cas is\u201d for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.\u202f
\nMicrosoft contributed to this Alert.
ABB became aware of vulnerability in the products versions listed as affected in the advisory. An update is available that resolves the reported vulnerabilities. An attacker who successfully exploited any of these vulnerabilities could potentially compromise the system in different ways.
\nThe following versions of ABB T-MAC Plus are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 9.9 | \nABB | \nABB T-MAC Plus | \nFiles or Directories Accessible to External Parties, Authorization Bypass Through User-Controlled Key, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Incorrect Authorization | \n
File Disclosure in ABB T-MAC Plus web application allows authenticated users to exfiltrate files containing sensitive information via crafted HTTP GET request.
\n\nVendor fix
ABB has investigated these vulnerabilities to provide adequate protection to customers. The problem is corrected in the following product versions: T-MAC Plus version 4.0-25 ABB recommends that customers apply the update at earliest convenience.
Mitigation
The misconfigurations on the IIS server, which were reported to security auditing, have been corrected. File Browsing Feature was enabled on that IIS server. That feature along with the default IIS site has been removed.
Workaround
Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove the exposure with well-known impact on functionality. ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as \u201cImpact of workaround\u201d.
Relevant CWE: CWE-552 Files or Directories Accessible to External Parties
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.9 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | \n
Broken access controls in ABB T-MAC Plus web application allows unprivileged users to performs administrative operations
\n\nVendor fix
ABB has investigated these vulnerabilities to provide adequate protection to customers. The problem is corrected in the following product versions: T-MAC Plus version 4.0-25 ABB recommends that customers apply the update at earliest convenience.
Mitigation
ABB T-MAC Plus web application supports several classes of users (e.g., Admin, Customer, Operator, etc.) with different roles. An authenticated user with low privileges (e.g., Customer) can execute administrative operations. The privileges associated to the different users have been revised and applied correctly.
Workaround
Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove the exposure with well-known impact on functionality. ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as \u201cImpact of workaround\u201d.
Relevant CWE: CWE-639 Authorization Bypass Through User-Controlled Key
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
Stored Cross-Site Scripting (XSS) in ABB T-MAC Plus web application allows authenticated users to execute arbitrary HTML or JavaScript code on victims browser.
\n\nVendor fix
ABB has investigated these vulnerabilities to provide adequate protection to customers. The problem is corrected in the following product versions: T-MAC Plus version 4.0-25 ABB recommends that customers apply the update at earliest convenience.
Mitigation
A DOM-based XSS vulnerability is present. If a malicious actor gains access to the operations network and can create or edit an existing entity, they could insert malicious JavaScript code to be executed in the web forms. New T-MAC Plus version 4.0-25 will correct the vulnerability.
Workaround
Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove the exposure with well-known impact on functionality. ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as \u201cImpact of workaround\u201d.
Relevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H | \n
Insecure network protocol in ABB T-MAC Plus allows unauthenticated attackers to perform a denial-of-service (DoS) of the Card Reader service.
\n\nVendor fix
ABB has investigated these vulnerabilities to provide adequate protection to customers. The problem is corrected in the following product versions: T-MAC Plus version 4.0-25 ABB recommends that customers apply the update at earliest convenience.
Mitigation
If a malicious actor gains physical access to a serial device, disables it, connects a malicious device with same IP address, and sends a specially crafted message, the service responsible for communicating with the device will be blocked until a manual restart is performed. New T-MAC Plus version 4.0-25 will correct the vulnerability.
Workaround
Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove the exposure with well-known impact on functionality. ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as \u201cImpact of workaround\u201d.
Relevant CWE: CWE-863 Incorrect Authorization
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.4 | \nHIGH | \nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H | \n
The information in this document is subject to change without notice, and should not be construed as a commitment by ABB. ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.
\nWhat causes the vulnerability? - The vulnerabilities are caused by: - Wrong configuration in T-MAC Plus IIS Server. - Wrong configuration of privileges of users. - Lack of encryption in communication protocol. What is T-MAC Plus? - T-MAC Plus is a Terminal Management System (TMS) that handles the different operations (receipt and dispatch product, access control, product movement in the tank farm, \u2026) in a terminal. It is applicable to different type of products such as chemical and petroleum terminals, pipeline or refinery tankage, bulk plants or hydrogen terminals. The following components are affected: - TMAC Plus Web application - Communication protocol with Card Readers What might an attacker use the vulnerability to do? - An attacker who successfully exploited this vulnerability could cause the affected system node to stop or become inaccessible and allow the attacker to insert and run arbitrary code. How could an attacker exploit the vulnerability? - An attacker could try to exploit the vulnerability by creating a specially crafted message and sending the message to an affected system node. This would require that the attacker has access to the system network, by connecting to the network directly. Recommended practices help mitigate such attacks, see section Mitigating Factors. Could the vulnerability be exploited remotely? - No, to exploit this vulnerability an attacker would need to have physical access to an affected system node. Can functional safety be affected by an exploit of this vulnerability? - While these vulnerabilities primarily impact confidentiality, integrity, and availability, they do not directly affect functional safety in the traditional sense What does the update do? - The update removes the vulnerability by modifying the way that the T-MAC Plus web application and the communication protocol are configured. When this security advisory was issued, had this vulnerability been publicly disclosed? - No, ABB received information about this vulnerability through responsible disclosure. When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited? - No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of ABB PSIRT 9AKK108472A7840 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact ABB PSIRT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-06-03 | \n1 | \nInitial version. | \n
| 2026-07-14 | \n2 | \nInitial CISA Republication of ABB PSIRT 9AKK108472A7840 advisory | \n
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
", "summary_is_html": true, "first_seen": "Tue, 14 Jul 26 12:00:00 +0000", "last_updated": "Tue, 14 Jul 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a", "title": "Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a", "summary": "Russian Government-Sponsored Activity Targets Poorly Configured and Vulnerable Devices Across Critical Sectors
\nRussian Federal Security Service (FSB) Center 16 cyber actors continue to exploit poorly configured and vulnerable networking devices worldwide, opportunistically compromising multiple critical infrastructure sector networks. This joint Cybersecurity Advisory (CSA) builds on FBI\u2019s Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure Public Service Announcement of the decade-plus FSB Center 16 cyber activity by providing additional tactics, techniques, and procedures (TTPs) to enable defenders to more fully understand and counter the threat. [1]
\nThis CSA is being released by the following authoring and co-sealing agencies:
\nThe authoring and co-sealing agencies strongly urge device owners and network defenders to take mitigation and remediation actions against Russian government-sponsored exploitation of vulnerable routers.
\n\n\n\n\n\n\n\nDownload the PDF version of this report:
\n\nThe cybersecurity industry provides overlapping cyber threat intelligence, indicators of compromise (IOCs), and mitigation recommendations related to this activity. Although not all encompassing, the following list contains the most notable threat group names commonly used within the cybersecurity community related to this activity:
\nNote: Cybersecurity companies have different methods of tracking and attributing cyber actors, and this list may not provide a 1:1 correlation to the authoring agencies\u2019 understanding for all activity related to these groupings.
\nCritical infrastructure sectors most at risk from the Russian Federal Security Service (FSB) Center 16 cyber actors\u2019 targeting include:
\nNote: This advisory uses the MITRE ATT&CK\u00ae Matrix for Enterprise12 framework, version 19. See Appendix A for tables of the activity mapped to MITRE ATT&CK tactics and techniques. This advisory also uses MITRE DEFENDTM version 1.4.0.
\nThe Russian FSB Center 16 cyber actors primarily use scanning to identify poorly configured networking devices, primarily routers, for exploitation. The actors scan for Internet IP ranges with active Simple Network Management Protocol (SNMP) agents that accept common or default community strings for authentication [T1595.001, T1595.002]. These scans, run via proxies, consist of SNMP Set-Requests from a spoofed IP address [T1027] containing Object Identifiers (OIDs) that instruct the SNMP agent on poorly configured networking devices to [T1569, T1602.001, T1090]:
\nWhile SNMP scanning is the primary method the actors use to discover and exploit poorly configured networking devices, they occasionally exploit common vulnerabilities and exposures (CVEs) in Cisco devices, Cisco\u2019s Smart Install (SMI) functionality, and web portals to manage network devices. The actors previously exploited at least the following CVEs [T1584.008, T1588.005, T1190, T1068]:
\n\nMany of these TTPs overlap with activity by other malicious cyber actors, such as Salt Typhoon. Even though this CSA focuses on Russian FSB Center 16 cyber activity, the mitigations below should detect and counter these and similar TTPs used by other actors.
\nThe authoring agencies highly recommend network defenders implement the following mitigations to harden networks against this exploitation:
\nUnited States:
\n\nCanada:
\n[1] FBI. Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure. Alert Number: I-082025-PSA. 2025. https://www.ic3.gov/PSA/2025/PSA250820
\n[2] NSA. Cisco Smart Install Protocol Misuse. 2017. https://media.defense.gov/2019/Jul/16/2002157833/-1/-1/0/CSA-CISCO-SMART-INSTALL-PROTOCOL-MISUSE.PDF
\n[3] NSA. Network Infrastructure Security Guide. 2023. https://media.defense.gov/2022/Jun/15/2003018261/-1/-1/0/CTR_NSA_NETWORK_INFRASTRUCTURE_SECURITY_GUIDE_20220615.PDF
\n[4] NSA. Cybersecurity Information Sheet Cisco Password Types: Best Practices. 2022. https://media.defense.gov/2022/Feb/17/2002940795/-1/-1/0/CSI_CISCO_PASSWORD_TYPES_BEST_PRACTICES_20220217.PDF
\n[5] NSA. Cybersecurity Information Sheet: Reducing the Risk of Simple Network Management Protocol (SNMP) Abuse. 2026. https://media.defense.gov/2026/Jul/09/2003959459/-1/-1/0/CSI_REDUCING_RISK_OF_SNMP_ABUSE.PDF
\n1 N\u00e1rodn\u00ed \u00fa\u0159ad pro kybernetickou a informa\u010dn\u00ed bezpe\u010dnost
\n2 Forsvarets Efterretningstjeneste
\n3 V\u00e4lisluureamet
\n4 Riigi Infos\u00fcsteem Amet
\n5 Sotilastiedustelu
\n6 Suojelupoliisi
\n7 Agence nationale de la s\u00e9curit\u00e9 des syst\u00e8mes d\u2019information
\n8 Agenzia Informazioni e Sicurezza Esterna
\n9 Agenzia Informazioni e Sicurezza Interna
\n10 S\u0142u\u017cba Kontrwywiadu Wojskowego
\n11 Nationellt Cybers\u00e4kerhetscenter
\n12 MITRE and ATT&CK are registered trademarks of The MITRE Corporation. MITRE DEFEND is a trademark of the MITRE Corporation.
\n13 CVE-2008-4128 only affects end-of-life Cisco devices.
\nThe information and opinions contained in this document are provided \"as is\" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.
\nThis document was developed in furtherance of the authoring agencies\u2019 cybersecurity missions, including their responsibilities to identify and disseminate threats, and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.
\nUnited States organizations
\nAustralian organizations
\nCanadian organizations
\nNew Zealand organizations
\nUnited Kingdom organizations
\nEstonia organizations
\nFinnish organizations
\nFrench organizations
\nItalian Organizations
\nSee Table 1 through Table 10 for all the threat actor tactics and techniques referenced in this advisory.
\n| \n\n | \n\n ID \n | \n\n Use \n | \n
|---|---|---|
| Active Scanning: Scanning IP Blocks | \nT1595.001 | \nScan range of IP addresses | \n
| Active Scanning: Vulnerability Scanning | \nT1595.002 | \nScan victims for vulnerabilities that can be used during targeting | \n
| \n Technique Title \n | \n\n ID \n | \n\n Use \n | \n
|---|---|---|
| Acquire Infrastructure: Virtual Private Servers | \nT1583.003 | \nLeverage VPS as infrastructure | \n
| Compromise Infrastructure: Network Devices | \nT1584.008 | \nCompromise intermediate routers | \n
| Obtain Capabilities: Exploits | \nT1588.005 | \nUse publicly available code to exploit vulnerable devices | \n
| \n Technique Title \n | \n\n ID \n | \n\n Use \n | \n
|---|---|---|
| Exploit Public-Facing Application | \nT1190 | \nExploit publicly known CVEs | \n
| Proxy | \nT1090 | \nUse a connection proxy to direct network traffic | \n
| \n Technique Title \n | \n\n ID \n | \n\n Use \n | \n
|---|---|---|
| System Services | \nT1569 | \nExecuting commands via SNMP | \n
| \n Technique Title \n | \n\n ID \n | \n\n Use \n | \n
|---|---|---|
| Exploitation for Privilege Escalation | \nT1068 | \nExploit publicly known CVEs for escalated privileges | \n
| \n Technique Title \n | \n\n ID \n | \n\n Use \n | \n
|---|---|---|
| Obfuscated Files or Information | \nT1027 | \nObfuscate source IP addresses in system logs, as actions may be recorded as originating from local IP addresses | \n
| \n Technique Title \n | \n\n ID \n | \n\n Use \n | \n
|---|---|---|
| OS Credential Dumping | \nT1003 | \nCollect router configuration with weak Cisco Type 7 passwords and Type 0 | \n
| \n Technique Title \n | \n\n ID \n | \n\n Use \n | \n
|---|---|---|
| Data from Configuration Repository: SNMP (MIB Dump) | \nT1602.001 | \nTarget MIB to collect network information via SNMP | \n
| Data from Configuration Repository: Network Device Configuration Dump | \nT1602.002 | \nAcquire credentials by collecting network device configurations | \n
| \n Technique Title \n | \n\n ID \n | \n\n Use \n | \n
|---|---|---|
| Proxy | \nT1090 | \nUse VPS for C2 | \n
| Application Layer Protocol | \nT1071 | \nOpen and expose a variety of different services, including TFTP and FTP | \n
| \n\n | \n\n ID \n | \n\n Use \n | \n
|---|---|---|
| Exfiltration Over Alternative Protocol | \nT1048 | \nExfiltrating over a different protocol than that of the existing command and control channel. | \n
See Table 11 for a mapping of several of the cybersecurity countermeasures mentioned in this advisory.
\n| \n\n | \n\n ID \n | \n\n Description \n | \n
|---|---|---|
| Application Configuration Hardening | \nD3-ACH | \n\n
| \n
| Message Authentication | \nD3-MAN | \n\n
| \n
| Message Encryption | \nD3-MENCR | \n\n
| \n
| Credential Hardening | \nD3-CH | \n\n
| \n
| Platform Monitoring | \nD3-PM | \n\n
| \n
| Network Traffic Filtering | \nD3-NTF | \n\n
| \n
| Network Vulnerability Assessment | \nD3-NVA | \n\n
| \n
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
", "summary_is_html": true, "first_seen": "Mon, 13 Jul 26 12:00:00 +0000", "last_updated": "Mon, 13 Jul 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/alerts/2026/07/10/cisa-adds-two-known-exploited-vulnerabilities-catalog", "title": "CISA Adds Two Known Exploited Vulnerabilities to Catalog", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/alerts/2026/07/10/cisa-adds-two-known-exploited-vulnerabilities-catalog", "summary": "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
", "summary_is_html": true, "first_seen": "Fri, 10 Jul 26 12:00:00 +0000", "last_updated": "Fri, 10 Jul 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-190-01", "title": "OpenPLC v3", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-190-01", "summary": "\nSuccessful exploitation of this vulnerability could allow an authenticated attacker to write arbitrary files to the filesystem and escalate this into arbitrary native code execution through the normal OpenPLC program compilation process, potentially resulting in code execution as the OpenPLC runtime user.
\nThe following versions of OpenPLC v3 are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 9.9 | \nOpenPLC | \nOpenPLC v3 | \nExternal Control of File Name or Path | \n
OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program\u2011upload workflow. The application stores an attacker\u2011supplied filename (prog_file) directly into the Programs.File database field and later uses this value as the destination path for an uploaded file without validating or restricting the path. Because Python os.path.join() honors attacker\u2011controlled absolute paths, an authenticated user can write arbitrary files anywhere writable by the OpenPLC webserver process. In the default build pipeline, all C++ source files within the OpenPLC runtime core directory are automatically compiled into the executable runtime binary. By writing a malicious .cpp file into this directory, an authenticated attacker can escalate the arbitrary file write into arbitrary native code execution when the operator triggers a normal program compilation and runtime start.
\n\nVendor fix
OpenPLC recommends users upgrade to OpenPLC v4 as OpenPLC v3 is end-of-life and is no longer receiving patches, bug fixes, or security updates.
Relevant CWE: CWE-73 External Control of File Name or Path
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.9 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-09 | \n1 | \nInitial Publication | \n
Schneider Electric is aware of a vulnerability in its Easergy MiCOM Px40 Series products. The [Easergy MiCOM Px40](https://www.se.com/ww/en/product-subcategory/4725-easergy-micom-px40-series/?filter=business-6-medium-voltage-distribution-and-grid-automation) is a protection relay series for Medium Voltage, High Voltage and Extra High Voltage protection. Failure to apply the mitigations provided below may risk unauthorized exposure of basic device identification through the SNMP protocol.
\nThe following versions of Schneider Electric Easergy MiCOM Px40 Series are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 5.3 | \nSchneider Electric | \nSchneider Electric Easergy MiCOM Px40 Series | \nUse of Hard-coded Credentials | \n
CWE-798 Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to sensitive device information when an unauthenticated attacker is able to interrogate the SNMP port.
\n\nMitigation
For customers who do not require SNMP Contact Schneider Electric's [Customer Care Center](https://www.se.com/ww/en/work/support/contacts.jsp) to upgrade the Firmware to a version without SNMP functionality. If customers choose not to apply the upgrade provided above, they should immediately apply the following mitigations to reduce the risk of exploit: * Use relays only in a protected network environment, * Use firewalls to protect and separate the control system network from other networks, * Use VPN (Virtual Private Networks) tunnels if remote access is required. For customers who require SNMP Please immediately apply the following mitigations to reduce the risk of exploit: * Use relays only in a protected network environment, * Use firewalls to protect and separate the control system network from other networks, * Use VPN (Virtual Private Networks) tunnels if remote access is required.
Relevant CWE: CWE-798 Use of Hard-coded Credentials
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.3 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | \n
We strongly recommend the following industry cybersecurity best practices. * Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. * Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks. * Place all controllers in locked cabinets and never leave them in the \u201cProgram\u201d mode. * Never connect programming software to any network other than the network intended for that device. * Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks. * Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation. * Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet. * When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices. For more information refer to the Schneider Electric [Recommended Cybersecurity Best Practices](https://www.se.com/us/en/download/document/7EN52-0390/) document.
\nThis document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process. For further information related to cybersecurity in Schneider Electric's products, visit the company's cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp
\nTHIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS \u201cNOTIFICATION\u201d) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN \u201cAS-IS\u201d BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND. SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION
\nSchneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and sustainability for all. We call this Life Is On. Our mission is to be the trusted partner in Sustainability and Efficiency. We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation, software and services, delivering digital twins to enable profitable growth for our customers. We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our meaningful purpose of a sustainable future for all. www.se.com
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Schneider Electric CPCERT SEVD-2026-104-03 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Schneider Electric CPCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-04-14 | \n1 | \nOriginal Release | \n
| 2026-05-12 | \n2 | \nUpdated the risk associated with successful exploitation of this vulnerability and revised the remediation table to a mitigation table to emphasize that multiple mitigation options are available. | \n
| 2026-07-09 | \n3 | \nInitial CISA Republication of Schneider Electric CPCERT SEVD-2026-104-03 advisory | \n
Successful exploitation of these vulnerabilities could allow attackers to overwrite critical files, forge or inject malicious log data, gain unauthorized account access, trigger denial\u2011of\u2011service conditions, truncate or alter logging information, reset user credentials, or expose sensitive information.
\nThe following versions of Schneider Electric PowerChute Serial Shutdown are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 6.1 | \nSuSE, Schneider Electric, Red Hat, Microsoft | \nSchneider Electric PowerChute Serial Shutdown | \nImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Encoding or Escaping of Output, Improper Restriction of Excessive Authentication Attempts, Uncontrolled Resource Consumption, Improper Validation of Specified Quantity in Input, Improper Neutralization of CRLF Sequences ('CRLF Injection'), Insertion of Sensitive Information into Log File | \n
PowerChute is vulnerable to improper restriction of file paths, which could allow critical system files to be overwritten with unintended data.
\n\nVendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/
Vendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/
Mitigation
Specific instructions and hardening guidelines for these mitigations can be found in the Security Handbook.
https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN
Vendor fix
The following product versions have been fixed: PowerChute Serial Shutdown Version 1.5 installed on Microsoft Windows are fixed versions for CVE-2026-2399.
Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Red Hat Enterprise Linux are fixed versions for CVE-2026-2399.
Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on SuSE Linux are fixed versions for CVE-2026-2399.
Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf
Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json
Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.1 | \nMEDIUM | \nCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H | \n
| 4.0 | \n6.9 | \nMEDIUM | \nCVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N | \n
PowerChute is vulnerable to improper output encoding, which may allow crafted input to be reflected in log files in unexpected ways.
\n\nVendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/
Vendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/
Mitigation
Specific instructions and hardening guidelines for these mitigations can be found in the Security Handbook.
https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN
Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Microsoft Windows are fixed versions for CVE-2026-2404.
Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Red Hat Enterprise Linux are fixed versions for CVE-2026-2404.
Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on SuSE Linux are fixed versions for CVE-2026-2404.
Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf
Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json
Relevant CWE: CWE-116 Improper Encoding or Escaping of Output
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.3 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | \n
| 4.0 | \n6.9 | \nMEDIUM | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | \n
PowerChute is vulnerable to insufficient limitations on repeated authentication attempts across multiple endpoints.
\n\nVendor fix
(CVE-2026-2402) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/
Vendor fix
(CVE-2026-2402) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/
Mitigation
Specific instructions and hardening guidelines for these mitigations can be found in the Security Handbook.
https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN
Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Microsoft Windows are fixed versions for CVE-2026-2402.
Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Red Hat Enterprise Linux are fixed versions for CVE-2026-2402.
Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on SuSE Linux are fixed versions for CVE-2026-2402.
Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf
Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json
Relevant CWE: CWE-307 Improper Restriction of Excessive Authentication Attempts
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.3 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | \n
| 4.0 | \n6.9 | \nMEDIUM | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N | \n
PowerChute is vulnerable to uncontrolled resource consumption when certain system operations are triggered excessively.
\n\nVendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/
Vendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/
Mitigation
Specific instructions and hardening guidelines for these mitigations can be found in the Security Handbook.
https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN
Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Microsoft Windows are fixed versions for CVE-2026-2405.
Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Red Hat Enterprise Linux are fixed versions for CVE-2026-2405.
Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on SuSE Linux are fixed versions for CVE-2026-2405.
Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf
Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json
Relevant CWE: CWE-400 Uncontrolled Resource Consumption
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n4.3 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L | \n
| 4.0 | \n5.3 | \nMEDIUM | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N | \n
PowerChute is vulnerable to improper validation of quantity\u2011related inputs, which can cause event and data logs to be truncated. As a result, important audit information may be lost, reducing visibility into system behavior.
\n\nVendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/
Vendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/
Mitigation
Specific instructions and hardening guidelines for these mitigations can be found in the Security Handbook.
https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN
Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Microsoft Windows are fixed versions for CVE-2026-2403.
Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Red Hat Enterprise Linux are fixed versions for CVE-2026-2403.
Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on SuSE Linux are fixed versions for CVE-2026-2403.
Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf
Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json
Relevant CWE: CWE-1284 Improper Validation of Specified Quantity in Input
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n4.3 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N | \n
| 4.0 | \n5.3 | \nMEDIUM | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | \n
PowerChute is vulnerable to improper handling of newline sequences in certain inputs, enabling unexpected modification of configuration\u2011related data.
\n\nVendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/
Vendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/
Mitigation
Specific instructions and hardening guidelines for these mitigations can be found in the Security Handbook.
https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN
Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Microsoft Windows are fixed versions for CVE-2026-2400.
Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Red Hat Enterprise Linux are fixed versions for CVE-2026-2400.
Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on SuSE Linux are fixed versions for CVE-2026-2400.
Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf
Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json
Relevant CWE: CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n4.3 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L | \n
| 4.0 | \n5.3 | \nMEDIUM | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N | \n
PowerChute is vulnerable to improper logging of sensitive information when certain user\u2011triggered operations occur.
\n\nVendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/
Vendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/
Mitigation
Specific instructions and hardening guidelines for these mitigations can be found in the Security Handbook.
https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN
Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Microsoft Windows are fixed versions for CVE-2026-2401.
Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Red Hat Enterprise Linux are fixed versions for CVE-2026-2401.
Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on SuSE Linux are fixed versions for CVE-2026-2401.
Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf
Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json
Relevant CWE: CWE-532 Insertion of Sensitive Information into Log File
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n2.8 | \nLOW | \nCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N | \n
| 4.0 | \n2.4 | \nLOW | \nCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-04-14 | \n1 | \nInitial Publication | \n
| 2026-07-09 | \n2 | \nInitial Republication of Schneider Electric CPCERT SEVD-2026-104-01 | \n
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
", "summary_is_html": true, "first_seen": "Tue, 07 Jul 26 12:00:00 +0000", "last_updated": "Tue, 07 Jul 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-188-01", "title": "Hydro-Qu\u00e9bec Le Circuit Electrique charging station backend", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-188-01", "summary": "\nSuccessful exploitation of these vulnerabilities could lead to privilege escalation, or result in a denial-of-service attack.
\nThe following versions of Hydro-Qu\u00e9bec Le Circuit Electrique charging station backend are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 9.8 | \nHydro-Qu\u00e9bec | \nHydro-Qu\u00e9bec Le Circuit Electrique charging station backend | \nImproper Access Control, Improper Restriction of Excessive Authentication Attempts, Insufficient Session Expiration | \n
The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation.
\n\nMitigation
Hydro-Qu\u00e9bec has updated the majority of charging stations to disable OCPP, mitigating the risk of exploitation. Hydro-Qu\u00e9bec has also implemented authentication systems to mitigate the issue for certain charging stations which are still reliant on OCPP. Contact Hydro-Qu\u00e9bec with any additional questions.
Relevant CWE: CWE-284 Improper Access Control
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
| 4.0 | \n9.3 | \nCRITICAL | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
Previously, there was no throttling on repeated authentication attempts to the charging station backend, which could allow an attacker to execute a Denial-of-Service attack.
\n\nMitigation
Hydro-Qu\u00e9bec has updated the majority of charging stations to disable OCPP, mitigating the risk of exploitation. Hydro-Qu\u00e9bec has also implemented authentication systems to mitigate the issue for certain charging stations which are still reliant on OCPP. Contact Hydro-Qu\u00e9bec with any additional questions.
Relevant CWE: CWE-307 Improper Restriction of Excessive Authentication Attempts
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | \n
Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend.
\n\nMitigation
Hydro-Qu\u00e9bec has updated the majority of charging stations to disable OCPP, mitigating the risk of exploitation. Hydro-Qu\u00e9bec has also implemented authentication systems to mitigate the issue for certain charging stations which are still reliant on OCPP. Contact Hydro-Qu\u00e9bec with any additional questions.
Relevant CWE: CWE-613 Insufficient Session Expiration
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-07 | \n1 | \nInitial Publication | \n
Successful exploitation of these vulnerabilities could disclose information and allow a malicious user to execute arbitrary code on affected installations.
\nThe following versions of Labcenter Proteus 9 are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.8 | \nLabcenter Electronics | \nLabcenter Proteus 9 | \nOut-of-bounds Write, Stack-based Buffer Overflow, Use After Free | \n
The application contains an out-of-bounds write vulnerability that can be exploited by an attacker to cause the program to write data past the end of an allocated memory buffer. This can lead to arbitrary code execution.
\n\nVendor fix
Labcenter recommends ensuring you are using the latest version (9.2 SPO) of the software. Version can be found by looking at the bottom left of the Proteus home page (Version 8 or higher) or by selecting the About ISIS or About ARES option from the Help menu. Update notifications appear in the new and information section of the home page where you can activate the download and installation directly.
Mitigation
If you have questions or need help please contact Labcenter or your local distributor.
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
| 4.0 | \n8.4 | \nHIGH | \nCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
The application contains a stack-based buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code.
\n\nVendor fix
Labcenter recommends ensuring you are using the latest version (9.2 SPO) of the software. Version can be found by looking at the bottom left of the Proteus home page (Version 8 or higher) or by selecting the About ISIS or About ARES option from the Help menu. Update notifications appear in the new and information section of the home page where you can activate the download and installation directly.
Mitigation
If you have questions or need help please contact Labcenter or your local distributor.
Relevant CWE: CWE-121 Stack-based Buffer Overflow
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
| 4.0 | \n8.4 | \nHIGH | \nCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
The application contains a use-after-free vulnerability that can be exploited to cause memory corruption while parsing specially crafted files. This could allow an attacker to execute arbitrary code in the context of the current process.
\n\nVendor fix
Labcenter recommends ensuring you are using the latest version (9.2 SPO) of the software. Version can be found by looking at the bottom left of the Proteus home page (Version 8 or higher) or by selecting the About ISIS or About ARES option from the Help menu. Update notifications appear in the new and information section of the home page where you can activate the download and installation directly.
Mitigation
If you have questions or need help please contact Labcenter or your local distributor.
Relevant CWE: CWE-416 Use After Free
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
| 4.0 | \n8.4 | \nHIGH | \nCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-07 | \n1 | \nInitial Publication | \n
Mendix Studio Pro versions before V11.12 are affected by a file parsing vulnerability that could be triggered when the application reads specially crafted malicious project during the build pipeline. This could allow an attacker to execute arbitrary code in the context of that user. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.
\nThe following versions of Siemens Mendix Studio Pro are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 5.4 | \nSiemens | \nSiemens Mendix Studio Pro | \nImproper Control of Generation of Code ('Code Injection') | \n
Affected versions of Mendix Studio Pro do not properly validate or sanitize project files processed during the build pipeline. This could allow an attacker who tricks a user into opening and running a specially crafted malicious project locally on their system to execute arbitrary code in the context of that user.
\n\nNo fix planned
Currently no fix is planned
Vendor fix
Update to V10.24.21 or later version
https://docs.mendix.com/releasenotes/studio-pro/10.24/
Vendor fix
Update to V11.6.7 or later version
https://docs.mendix.com/releasenotes/studio-pro/11.6/
Relevant CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.4 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N | \n
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-779310 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-06-30 | \n1 | \nPublication Date | \n
| 2026-07-07 | \n2 | \nInitial CISA Republication of Siemens ProductCERT SSA-779310 advisory | \n
Hitachi Energy is aware of a buffer overflow vulnerability that affects e-mesh EMS product versions listed in this document. Successful exploitation of this vulnerability could lead to a buffer overflow condition, potentially resulting in application outages (denial of service) and possible arbitrary code execution. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.
\nThe following versions of Hitachi Energy e-mesh EMS are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 8.1 | \nHitachi Energy | \nHitachi Energy e-mesh EMS | \nHeap-based Buffer Overflow | \n
NGINX Plus and NGINX Open Source used in e-mesh EMS have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. e-mesh EMS versions using NGINX v1.30.0 and below are affected.
\n\nVendor fix
Apply hotfix for respective e-mesh EMS versions to update NGINX to either v1.30.2 or latest
Mitigation
Ensure rewrite configuration does not contain \"?\" to replace unnamed captures, and ensure ASLR is set to active (value=2) across all deployment targets covering all 3 versions.
Mitigation
Underlying Ubuntu Server 20.04 LTS is End of Life. For e-mesh EMS versions 4.1.6/4.4.2 using Ubuntu 20.04 LTS, upgrade to Ubuntu Server 22.04, or 24.04, or activate Ubuntu Pro/ESM as an interim measure.
Relevant CWE: CWE-122 Heap-based Buffer Overflow
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.1 | \nHIGH | \nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
| 4.0 | \n9.2 | \nCRITICAL | \nCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
The information in this document is subject to change without notice and should not be construed as a commitment by Hitachi Energy. Hitachi Energy provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall Hitachi Energy or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if Hitachi Energy or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from Hitachi Energy and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.
\nFor additional information and support please contact your product provider or Hitachi Energy service organization. For contact information, see https://www.hitachienergy.com/contact-us/ for Hitachi Energy contact-centers.
\nRecommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system. Proper password policies and processes should be followed. Additional information on Industrial Control Systems Cybersecurity Best Practices can be found in the Hitachi Energy \u201cIndustrial Control Systems Cybersecurity Best Practices\u201d Cybersecurity Notification. [1]
\nSSVCv2/E:N/A:N/2026-06-29T17:00:59Z/
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Hitachi Energy PSIRT 8DBD000253 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Hitachi Energy PSIRT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-06-30 | \n1 | \nInitial public release | \n
| 2026-07-07 | \n2 | \nInitial CISA Republication of Hitachi Energy PSIRT 8DBD000253 advisory | \n
Hitachi Energy is aware of insecure HTTP transmission vulnerability in PROMOD V product versions listed in this document. This vulnerability could allow attackers to intercept or manipulate sensitive data in transit, potentially leading to credential theft, session hijacking, or unauthorized access.
\nThe following versions of Hitachi Energy PROMOD V are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.1 | \nHitachi Energy | \nHitachi Energy PROMOD V | \nReliance on HTTP instead of HTTPS | \n
PROMOD V is using insecure HTTP communication instead of HTTPS. The vulnerability is due to the lack of HTTPS support from 3rd party Digipede server.
\n\nVendor fix
Upgrade to version 1.0.11 and enable HTTPS on Digipede server. [2] Refer to \u201c1.0.11 PROMOD V User Guide\u201d, Section 2 Essential Skills->Running PROMOD V->Digipede Grid. Alternatively, refer to the same section in the online help contained in the application.
Mitigation
Apply general mitigation factors
Relevant CWE: CWE-1428 Reliance on HTTP instead of HTTPS
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.1 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N | \n
| 4.0 | \n7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N | \n
The information in this document is subject to change without notice and should not be construed as a commitment by Hitachi Energy. Hitachi Energy provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall Hitachi Energy or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if Hitachi Energy or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from Hitachi Energy and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.
\nFor additional information and support please contact your product provider or Hitachi Energy service organization. For contact information, see https://www.hitachienergy.com/contact-us/ for Hitachi Energy contact-centers.
\nRecommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system. Proper password policies and processes should be followed. Additional information on Industrial Control Systems Cybersecurity Best Practices can be found in the Hitachi Energy \u201cIndustrial Control Systems Cybersecurity Best Practices\u201d Cybersecurity Notification. [1]
\nSSVCv2/E:N/A:N/2026-06-29T12:01:59Z/
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Hitachi Energy PSIRT 8DBD000250 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Hitachi Energy PSIRT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-06-30 | \n1 | \nInitial public release | \n
| 2026-07-07 | \n2 | \nInitial CISA Republication of Hitachi Energy PSIRT 8DBD000250 advisory | \n