![\"Figure](\"/sites/default/files/styles/large/public/2026-07/figure1.png?itok=yrzcl7tK\")
\n\n\n\nSuccessful exploitation of these vulnerabilities could allow a non-privileged user to escalate privileges or view the credentials of other users.
\nThe following versions of Weintek cMT3092X are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 8.8 | \nWeintek | \nWeintek cMT3092X | \nReliance on Cookies without Validation and Integrity Checking in a Security Decision, Incorrect Permission Assignment for Critical Resource, Plaintext Storage of a Password, Incorrect User Management | \n
Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges.
\n\nVendor fix
Weintek recommends users apply the patch package named cmt_typeB_20260316_007.patch, which contains a newer EasyWeb 2.3.17-typeb. This fix will be delivered as a patch-only update; no separate standard firmware release is planned. Users may request the patch directly from Weintek support (https://www.weintek.com/globalw/Support/Knowledge.aspx) or from distributors.
https://www.weintek.com/globalw/Support/Knowledge.aspx
Mitigation
Weintek has published a document with more details about this issue at https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf.
https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf
Relevant CWE: CWE-784 Reliance on Cookies without Validation and Integrity Checking in a Security Decision
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges.
\n\nVendor fix
Weintek recommends users apply the patch package named cmt_typeB_20260316_007.patch, which contains a newer EasyWeb 2.3.17-typeb. This fix will be delivered as a patch-only update; no separate standard firmware release is planned. Users may request the patch directly from Weintek support (https://www.weintek.com/globalw/Support/Knowledge.aspx) or from distributors.
https://www.weintek.com/globalw/Support/Knowledge.aspx
Mitigation
Weintek has published a document with more details about this issue at https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf.
https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf
Relevant CWE: CWE-732 Incorrect Permission Assignment for Critical Resource
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
Weintek cMT3092X HMI stores user account passwords in plaintext.
\n\nVendor fix
Weintek recommends users apply the patch package named cmt_typeB_20260316_007.patch, which contains a newer EasyWeb 2.3.17-typeb. This fix will be delivered as a patch-only update; no separate standard firmware release is planned. Users may request the patch directly from Weintek support (https://www.weintek.com/globalw/Support/Knowledge.aspx) or from distributors.
https://www.weintek.com/globalw/Support/Knowledge.aspx
Mitigation
Weintek has published a document with more details about this issue at https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf.
https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf
Relevant CWE: CWE-256 Plaintext Storage of a Password
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | \n
| 4.0 | \n7.1 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | \n
An attacker can modify data that should be restricted to read\u2011only access.
\n\nVendor fix
Weintek recommends users apply the patch package named cmt_typeB_20260316_007.patch, which contains a newer EasyWeb 2.3.17-typeb. This fix will be delivered as a patch-only update; no separate standard firmware release is planned. Users may request the patch directly from Weintek support (https://www.weintek.com/globalw/Support/Knowledge.aspx) or from distributors.
https://www.weintek.com/globalw/Support/Knowledge.aspx
Mitigation
Weintek has published a document with more details about this issue at https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf.
https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf
Relevant CWE: CWE-286 Incorrect User Management
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N | \n
| 4.0 | \n7.1 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take the following measures to protect themselves from social engineering attacks:
\nPractice principles of least privilege.
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-23 | \n1 | \nInitial Publication | \n
Successful exploitation of this vulnerability could allow an authenticated attacker to write arbitrary files to restricted system directories outside of the application's intended directory.
\nThe following versions of Rockwell Automation ThinManager are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 8.1 | \nRockwell Automation | \nRockwell Automation ThinManager | \nImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | \n
A path traversal security issue exists within Rockwell Automation ThinManager software due to improper limitation of file save operations within the API. An authenticated attacker could exploit this vulnerability to write arbitrary files to restricted system directories outside of the application's intended directory.
\n\nMitigation
Users using the affected software, should upgrade to one of the corrected versions as follows:
Vendor fix
ThinManager Versions 13.0.0 - 13.0.7 --> 13.0.8
Vendor fix
ThinManager Versions 13.1.0 - 13.1.5 --> 13.1.6
Vendor fix
ThinManager Versions 13.2.0 - 13.2.4 --> 13.2.5
Vendor fix
ThinManager Versions 14.0.0 - 14.0.2 --> 14.0.3
Mitigation
Users using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices.
https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight
Mitigation
For more information, refer to Rockwell Automation's Securitry Advisory page.
https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html
Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.1 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H | \n
| 4.0 | \n7.2 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-14 | \n1 | \nInitial Publication by Rockwell Automation | \n
| 2026-07-23 | \n2 | \nInitial Republication of Rockwell Automation advisory | \n
A group of Russian state-supported cyber actors has been targeting and compromising various Western government and commercial organizations using the Zimbra Collaboration Suite (ZCS) software since at least July 2025. The Russian state-supported advanced persistent threat (APT) group\u2019s activity is tracked in the cybersecurity community under several names (see Cybersecurity industry tracking), primarily as \u201cLAUNDRY BEAR,\u201d a name initially coined by the Netherlands General Intelligence and Security Service (AIVD) and Defence Intelligence and Security Service (MIVD) [1].
\nLAUNDRY BEAR\u2019s targeting is almost certainly to gather sensitive information for the Russian Federation, with these actors primarily focusing on the covert acquisition of email data. Previous campaigns indicated LAUNDRY BEAR relied on unsophisticated initial access techniques\u2014including password spraying, phishing, and pass-the-cookie\u2014allowing the group to successfully run high-volume operations. The latest campaign targeting ZCS uses a novel exploit that was a zero-day vulnerability when first exploited and continues to be successfully exploited. The vulnerability, Common Vulnerabilities and Exposures (CVE) CVE-2025-66376, was patched in November 2025. This demonstrates LAUNDRY BEAR\u2019s intent and ability to deploy increasingly sophisticated technical capabilities.
\nUnlike traditional phishing campaigns that persuade a user into taking an action, such as clicking a link or opening a file, LAUNDRY BEAR\u2019s latest campaign leverages a view-based exploit that only requires a user to view a malicious email within a vulnerable version of the webmail service. Once viewed, the exploit attempts to exfiltrate the victim\u2019s last 90 days of email communications, the organization email directory (i.e., Global Address List [GAL]), and other sensitive information to servers controlled by LAUNDRY BEAR. The exploit also attempts to establish persistent access to victim accounts through a variety of means as detailed in the Persistence and credential access section.
\nThis Cybersecurity Advisory (CSA) warns of this ongoing malicious threat activity and urges organizations to update their vulnerable software and implement additional mitigations to thwart these Russian state-supported actors\u2019 continued success. The CSA is being released by the following authoring and co-sealing agencies:
\nThe authoring agencies urge any organizations using ZCS to implement the recommendations listed within the Mitigations section of this advisory to reduce the risk associated with this activity. This CSA also includes specific remediations for organizations to implement if they discover the presence of the listed Indicators of compromise (IOCs).
\nAs more organizations update their ZCS software based on this CSA, LAUNDRY BEAR may discontinue the current campaign exploiting this vulnerability; however, based on the success of this and previous campaigns, it is very likely that the group will continue to target ZCS and other email systems used by organizations in Western countries. The actors will almost certainly continue to rely on email to engage potential victims by exploiting novel vulnerabilities and, when necessary, use social engineering techniques to assist with their efforts. The authoring agencies recommend organizations regularly update their mail service software and continuously monitor their email systems and emails for malicious activity.
\nFor a downloadable list of IOCs, see:
\nThe cybersecurity industry provides overlapping cyber threat intelligence, indicators of compromise (IOCs), and mitigation recommendations related to these Russian state-supported cyber actors. While not exhaustive, the following are threat group names commonly used for these actors within the cybersecurity community:
\n\nNote: Cybersecurity companies have different methods of tracking and attributing cyber actors, and this may not be a 1:1 correlation to the U.S. government\u2019s understanding for all activity related to these groupings.
\nPublic advisories from Netherlands General Intelligence and Security Service (AIVD), Netherlands Defence Intelligence and Security Service (MIVD), and Microsoft highlighted these Russian state-supported advanced persistent threat (APT) actors in May 2025, calling them LAUNDRY BEAR and Void Blizzard respectively [1] [2]. Both advisories assessed that the group was engaged in malicious cyber activity as early as April 2024.
\nThe May 2025 advisories highlighted a cluster of activity targeting cloud-based email environments, including Microsoft Exchange in particular, and abusing legitimate APIs to perform data exfiltration in bulk [T1114.002]. The group relied on unsophisticated means of initial access, including procuring stolen credentials on criminal marketplaces [T1078], and using social engineering techniques to lure targets into interacting with a malicious site masquerading as a legitimate one. As of April 2025, one of these sites resembled a European Defence & Security Summit registration portal that required registrants to sign in to their Microsoft account to view. Once a user entered their Microsoft credentials into this malicious site, LAUNDRY BEAR\u2019s modified version of the open source adversary emulation toolkit, Evilginx, intercepted the user\u2019s credentials. LAUNDRY BEAR then used this authentication data, including passwords and session tokens, to access the compromised account and conduct mass email exfiltration, as well as harvest other information. This method of compromise is commonly known as an adversary-in-the-middle (AiTM) technique [T1557].
\nBeginning around July 2025, LAUNDRY BEAR shifted toward a more technical method of email compromise, highlighting their continued efforts to covertly acquire email communications from a variety of Western organizations of interest and deliver them to the Russian Federation. Using a custom-developed capability [T1587.001] named \u201c\u0423\u043b\u0435\u0439\u201d or \u201cUlej\u201d (Russian for beehive), LAUNDRY BEAR successfully targeted and exfiltrated sensitive user information from organizations who use the Zimbra Collaboration Suite (ZCS) product [T1114]. Data LAUNDRY BEAR attempted to exfiltrate from compromised accounts included:
\nThe covert and persistent nature of this activity, along with the absence of any known financial extortion, almost certainly indicates this group\u2019s involvement in espionage activities with Russian government backing. Additionally, extensive Ukrainian targeting, prior to use against U.S. and other NATO allies, outlines an increasing trend within Russian cyber threat groups to target Ukrainian users first\u2014both as a priority target and as a testbench for malicious cyber techniques before broader global deployment.
\nLAUNDRY BEAR has targeted and compromised users in various organizations, including those associated with:
\nNote:\u202fThis advisory uses the\u202fMITRE ATT&CK\u00ae\u202fMatrix for Enterprise\u202fframework, version 19.\u202fThis advisory also uses MITRE D3FENDTM version 1.4.015. See Appendix A and Appendix B for tables of the activity mapped to MITRE ATT&CK and D3FEND tactics, techniques, and countermeasures.
\nUlej is a novel data exfiltration and aggregation capability, that currently (as of the publication of this report) supports a campaign specifically targeting users of ZCS webmail servers. This capability is used to exploit CVE-2025-66376 [Common Weakness Enumeration (CWE) CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')], but likely could be adapted to exploit other vulnerabilities. It exfiltrates emails and other sensitive user data from a victim\u2019s system immediately after exploitation and stores the data in an actor-controlled unattributable virtual private server (VPS) [T1074.002] running LAUNDRY BEAR\u2019s \u201cFlowerbed\u201d collection framework. The collected data is almost certainly further exfiltrated to internal network resources for review and long-term retention.
\nLAUNDRY BEAR uses the Ulej capability to exploit the CVE-2025-66376 vulnerability in organizations using ZCS. This campaign\u2019s targeted victimology and limited exploitation capabilities likely indicate this group manually identifies and targets the victim organizations. LAUNDRY BEAR likely identifies organizations with public-facing Zimbra infrastructure by port scanning [T1595] and fingerprinting datasets easily procured through various commercial vendors [T1596.005].
\nAfter identifying a target organization, the group likely compiles email addresses for individual users to target with the exploit [T1589.002] from datasets offered by commercial vendors [T1597.002], open source intelligence [T1593], or previously exfiltrated data [T1597].
\nThe actors procure VPSs from a variety of providers [T1583.003], including those with Know Your Customer (KYC) requirements, and often use fabricated identities. LAUNDRY BEAR primarily uses Mullvad VPN [T1583] when interacting with these servers, further demonstrating the group\u2019s intent to mask their identity and maintain operations security (OPSEC). After the server is provisioned, an automated process deploys the Docker containers necessary for Ulej\u2019s Flowerbed framework [T1608], which then receives and aggregates the data Ulej exfiltrates. These servers are typically only used for 7-60 days before moving to new infrastructure.
\nFlowerbed is a Python project that uses Docker for containerization. The project includes four different Docker containers:
\nCatcher acts as both a DNS and HTTP server to receive and aggregate exfiltrated victim information [T1048]. For additional information on Catcher, refer to the Exfiltration section of this advisory. Flowerbed\u2019s next container, Certbot, is based on one of the official Certbot containers, which allows for automated generation of Let\u2019s Encrypt certificates using DNS challenges through Cloudflare. This certificate can then be used by the Nginx container, which serves as an HTTPS reverse proxy for Catcher, enabling Flowerbed to disguise some of its exfiltration activity through an encrypted communications channel [T1048.002]. The Nginx reverse proxy also validates that the Server Name Indicator (SNI) value contains \u201c*.i.*\u201d prior to forwarding the traffic to Catcher. If the SNI does not contain that string, the Nginx server returns a 444 error to the client. This is likely an attempt to reject non-Ulej connections. Finally, the Gardener container functions as a health check for the Catcher service. Gardener is a simple Python script that validates Catcher correctly receives and processes data.
\nThe simplistic Flowerbed codebase has indications that artificial intelligence (AI) played a role in its development. This highlights how AI is increasingly being used to develop malicious capabilities [T1588.007]. The dependence on AI for a simple capability, such as Flowerbed, alongside a previous reliance on open source capabilities, such as Evilginx2 [T1588.002], likely indicates a lack of advanced technical knowledge within LAUNDRY BEAR, especially in relation to true software development capabilities.
\nTo gain initial access, LAUNDRY BEAR sends an email containing a malicious JavaScript payload to the target [T1566]. Through exploitation of CVE-2025-66376, this JavaScript payload is immediately executed once the user views the malicious email [T1203], such as the one shown in Figure 1, in the ZCS webmail platform. Since at least November 2025, LAUNDRY BEAR began sending these phishing emails from victim infrastructure through compromised accounts [T1199], as shown in the email metadata in Figure 2. These compromised accounts were likely previous victims of this, or another LAUNDRY BEAR, campaign and their use is intended to further obfuscate and frustrate anti-phishing tools and training.
\n\n\n\n\n\n\n\n\n![\"Figure](\"/sites/default/files/styles/large/public/2026-07/figure2.png?itok=vEulmmyx\")
\n\n\n\nAccording to the National Vulnerability Database (NVD), CVE-2025-66376 was initially published on 5 January 2026. This vulnerability allows for execution of a JavaScript payload included in email content due to improper sanitization of Cascading Style Sheet\u2019s (CSS) @import directives within an email [5]. Because the activity attributed to this campaign began in July 2025\u2014months before Synacor released a patch and the CVE was published\u2014the payload initially exploited a zero-day vulnerability at that time [T1587.004].
\nUtilization of a zero-day exploit within this campaign demonstrates the ability for even emerging threat groups like LAUNDRY BEAR to operationalize novel exploits into a highly successful capability.
\nHidden in LAUNDRY BEAR\u2019s email is a Base64 encoded payload within the \u201conload\u201d field of a Scalable Vector Graphics (SVG) element [T1027.017], as shown in Figure 3. Leading up to the inclusion of this payload in the SVG element are various instances of @import directives, as required to leverage CVE-2025-66376. This payload includes an XOR encrypted final script encoded in a Base64 inner payload (see Figure 3) [T1027.013]. The outer payload decodes and decrypts the inner payload using an XOR function and a hardcoded key and then executes the script contained within the inner payload containing the collection and exfiltration logic. By changing the key used for the XOR encryption of the inner payload or adding additional @import directives with non-functional code [T1027.010], LAUNDRY BEAR can easily generate new payloads that bypass basic threat detection signatures. This malicious payload attempts to collect and exfiltrate information in 12 asynchronous stages [T1119]. The stages in order of appearance within the payload are as follows:
\n![\"Figure](\"/sites/default/files/styles/large/public/2026-07/figure3_0.png?itok=M-bj5-nb\")
\n\n\n\nUse of a zero-day exploit within this campaign demonstrates the ability for even emerging threat groups like LAUNDRY BEAR to operationalize novel exploits into a highly successful capability [T1587].
\nTo establish sustained persistence into the victim\u2019s email account, the script attempts to modify account preferences and collect authentication information. Any collected credentials are later exfiltrated, as further described in the Exfiltration section below. Other campaigns attributed to LAUNDRY BEAR also demonstrated the group\u2019s ability to circumvent multi-factor authentication through session token replay [T1550.004], and the Zimbra campaign follows a similar trend.
\nThe script used in this campaign tries to discover the victim\u2019s email address during the gather_email stage [T1087]. The script searches for this email address in two ways. First, it examines the batchInfoResponse variable, which an HTML script element on the webpage can define, for an email address. Even if the script finds an email address there, it also checks whether it acquired a Cross-Site Request Forgery (CSRF) token as described later in the Collection section of this advisory. If so, the script uses the \u201cGetIdentitiesRequest\u201d Simple Object Access Protocol (SOAP) command under the \u201cZimbraAccount\u201d namespace to determine the victim\u2019s email address [T1185] and then exfiltrates it. However, if the script does not have a CSRF token or the SOAP request fails, the script exfiltrates the email value recovered from the first method instead. If both attempts fail to capture the victim\u2019s email, the script sends a JavaScript Object Notation (JSON) payload with a key of \u201cemail\u201d and value of null over HTTPS and does not attempt DNS exfiltration.
\nDuring the gather_autocomplete_password stage, the script attempts to collect the victim\u2019s saved password via the autocomplete feature of the victim\u2019s password manager. The script injects two HTML div elements requesting login credentials onto the page outside of the victim\u2019s view, as shown in Figure 4 and Figure 5. After waiting five seconds, the script then attempts to extract the password provided automatically by the password manager from the input element shown in Figure 4. If there is no value in that input field, it checks the password input field shown in Figure 5. If neither input field contains a value, a JSON payload with a key of \u201cautocomplete_password\u201d and value of null is sent over HTTPS and DNS exfiltration is not attempted.
\n\n\n\n\n![\"Figure](\"/sites/default/files/styles/large/public/2026-07/figure4.png?itok=ZOZ8JHZC\")
\n\n\n\n![\"Figure](\"/sites/default/files/styles/large/public/2026-07/figure5.png?itok=8xZU_GCa\")
\n\n\n\nLAUNDRY BEAR almost certainly relies on a mail client using the Internet Message Access Protocol (IMAP) for persistent access to the victim\u2019s mailbox. During the enable_mail_protocols stage, a SOAP request leveraging the \u201cModifyPrefsRequest\u201d command under the \u201cZimbraAccount\u201d namespace is sent. This request attempts to set the \u201czimbraPrefImapEnabled\u201d preference to TRUE. While the default setting for \u201czimbraPrefImapEnabled\u201d is not well documented, this action is almost certainly intended to ensure that IMAP access to the victim\u2019s mailbox is enabled.
\nZCS does not support 2FA for some mail clients, including IMAP. To support users who rely on IMAP clients, ZCS allows for the generation of Application Passcodes. Application Passcodes are randomly generated passwords that can be used for clients that cannot support the normal 2FA process to authenticate. During the gather_app_password stage, the script makes a SOAP request using the \u201cCreateAppSpecificPasswordRequest\u201d command under the \u201cZimbraAccount\u201d namespace to create a new Application Passcode [T1556.006]. The SOAP request uses \u201cZimbraWeb\u201d as the name of the application.
\nAdditionally, the script also attempts to collect 2FA tokens. During the gather_2fa_codes stage, the script makes a SOAP request using the \u201cGetScratchCodesRequest\u201d command under the \u201cZimbraAccount\u201d namespace. The script then attempts to exfiltrate any non-null 2FA codes collected this way. The number of codes can vary, and each code is exfiltrated to Flowerbed individually.
\nAs demonstrated in the Persistence and credential access section, this script relies heavily on SOAP requests to collect victim information. To make these requests, the script aims to acquire the victim\u2019s current CSRF token, which it attempts to access within the webpage\u2019s local storage using localStorage.getItem(\"csrfToken\"). If the script is unable to acquire this CSRF token, it will be unable to make any SOAP requests. In addition to the SOAP commands documented in the Persistence and credential access section, other SOAP commands executed to collect victim information are shown in Table 1.
\n\n| \n \n \n\n \nSOAP Command \n | \n\n \n \n\n \nNamespace \n | \n\n \n \n\n \nStage \n | \n
|---|---|---|
| \n \n \n\n \nGetInfoRequest \n | \n\n \n \n\n \nzimbraAccount \n | \n\n \n \n\n \ngather_environment \n | \n
| \n \n \n\n \nGetDeviceStatusRequest \n | \n\n \n \n\n \nzimbraSync \n | \n\n \n \n\n \ngather_device_status \n | \n
| \n \n \n\n \nGetOAuthConsumersRequest \n | \n\n \n \n\n \nzimbraAccount \n | \n\n \n \n\n \ngather_oauth_consumers \n | \n
| \n \n \n\n \nSearchGalRequest \n | \n\n \n \n\n \nzimbraAccount \n | \n\n \n \n\n \ngather_gal \n | \n
The script attempts to collect the victim\u2019s GAL through brute force by searching for each two-character combination from a character set of \u201cabcdefghijklmnopqrstuvwxyz1234567890.-_\u201d. These queries are conducted using 20 batches of SOAP requests with 77 \u201cSearchGalRequest\u201d SOAP commands in each batch except for the last request containing only 58.
\nDuring the gather_environment stage, the script attempts to determine which type of ZCS webmail client the victim is using. The script checks the user\u2019s current URL to determine the client type being used, checking for certain indicators (shown in Table 2) to determine the client type. The corresponding value is then used as the payload when exfiltrating the client type.
\n\n| \n \n \n\n \nIndicator \n | \n\n \n \n\n \nClient Type \n | \n\n \n \n\n \nAssociated Value \n | \n
|---|---|---|
| \n \n \n\n \n?client=advanced \n | \n\n \n \n\n \nAdvanced \n | \n\n \n \n\n \nc \n | \n
| \n \n \n\n \n/h/ \n | \n\n \n \n\n \nStandard \n | \n\n \n \n\n \nh \n | \n
| \n \n \n\n \n/modern/ \n | \n\n \n \n\n \nModern \n | \n\n \n \n\n \nm \n | \n
As part of collection, the script attempts to harvest any emails not marked as \u201cjunk\u201d from the last 90 days from the victim\u2019s account. Emails are collected daily by an HTTP GET request to the URL path, \u201c/home/~/?fmt=tgz&meta=0&query=date:-{DAY_OFFSET}d AND (not in:junk)\u201d. The {DAY_OFFSET} value would be between 0 and 89 representing how many days ago the email was sent or received. To prevent redundant collection and exfiltration of emails, a variable with a name based on the email date being queried, using a format of zd_comp_YYYY-MM-DD, and value of true, is saved to the window.top.localStorage property. This variable is saved regardless of whether the email is successfully exfiltrated.
\nAccording to Mozilla documentation, if the user is not in a private browsing session, any data stored to localStorage does not typically expire. This means that if the user happens to execute the script again from the same computer, the script avoids attempting to re-exfiltrate previously captured emails. However, the script always attempts to pull any emails with a {DAY_OFFSET} of zero. In other words, the script always pulls emails sent or received the same day it is run. After email results are returned from the query for each day of email activity, those results are then passed to Flowerbed as described in the Exfiltration section.
\nThe script also provides LAUNDRY BEAR with telemetry on any errors that occur during the collection process. This is accomplished by executing any collection or exfiltration code through helper functions that contain error handling logic. If an error occurs, a payload containing information on the error itself, the context of the error happening, and the stage in which the error occurred is sent to Flowerbed as described in the Exfiltration section below. For cases where the error occurs within a SOAP request, \u201c:api\u201d is concatenated to the stage value in the payload. If an error occurs during the batch SOAP requests that occur when collecting the GAL of the victim, the stage value will use a format of gather_gal:{VAL}:api. The {VAL} placeholder indicates which batch request, a number from 0 to 19, the error occurred in. Errors that occur during the password autocomplete interception process will use \u201cgather_autocomplete_password:dom\u201d for the stage value. Finally, if an error occurs when attempting to collect or exfiltrate a specific day\u2019s emails, the stage will include which day the error occurred on, using the previously defined placeholder {DAY_OFFSET}, with a format of sendArchive:day-{DAY_OFFSET}.
\nAt the end of each stage in the collection process, the script attempts to exfiltrate acquired information to Flowerbed. The script primarily relies on two forms of data exfiltration: DNS [T1048.003] and HTTPS. Some information is exfiltrated over both the DNS and HTTPS channels.
\nPrior to exfiltration, a randomized 10- or 11-character alphanumeric string is generated as an identifier for the victim. This identifier is included in the URL of both the DNS- and HTTPS-based exfiltration.
\nDNS exfiltration occurs through DNS A record queries. To ensure data exfiltrated through DNS is not corrupted when traversing through non-actor-controlled DNS infrastructure, Ulej maintains compliance with RFC 1035, Domain Names - Implementation and Specification, specifically accounting for the case insensitivity and subdomain length requirements. Base32 encoding is used to create a case-insensitive payload. Once the payload is encoded, a period (\u201c.\u201d) is added every 60 characters to ensure each subdomain is under 63 characters long. The script then creates a new image object sourced from a URL with the scheme defined in Figure 6. Any traffic involving DNS exfiltration will have \u201cd-\u201c prefixing the victim identifier, and the subdomain immediately following indicates the type of information being exfiltrated.
\n\n\n\n\n![\"Figure](\"/sites/default/files/styles/large/public/2026-07/Figure6.png?itok=Tv8RT8o8\")
\n\n\n\nWhen the script generates an image object, the browser tries to retrieve the complete domain of the URL specified as the source of the image. This triggers a DNS request sent to the actor-controlled server and processed by Flowerbed. Table 3 lists both the information exfiltrated via DNS and their corresponding data type identifiers in the DNS queries.
\n\n| \n \n \n\n \nType of Information \n | \n\n \n \n\n \nExfiltration Stage \n | \n\n \n \n\n \nData Type \n | \n
|---|---|---|
| \n \n \n\n \nVictim\u2019s Email Address \n | \n\n \n \n\n \ngather_email \n | \n\n \n \n\n \ne \n | \n
| \n \n \n\n \nClient Type \n | \n\n \n \n\n \ngather_environment \n | \n\n \n \n\n \nc \n | \n
| \n \n \n\n \nZimbra Version \n | \n\n \n \n\n \ngather_environment \n | \n\n \n \n\n \nv \n | \n
| \n \n \n\n \nURL at Time of Exploitation \n | \n\n \n \n\n \ngather_environment \n | \n\n \n \n\n \nurl \n | \n
| \n \n \n\n \n2FA Scratch Codes \n | \n\n \n \n\n \ngather_2fa_codes \n | \n\n \n \n\n \n2fa \n | \n
| \n \n \n\n \nNewly Created Application Password \n | \n\n \n \n\n \ngather_app_password \n | \n\n \n \n\n \npa \n | \n
| \n \n \n\n \nHarvested Autocomplete Password \n | \n\n \n \n\n \ngather_autocomplete_password \n | \n\n \n \n\n \npw \n | \n
Any information exfiltrated via DNS is also exfiltrated through HTTPS, as well as additional data including email content, contacts, attachments, and error logging information. By using Let\u2019s Encrypt certificates, this group can quickly deploy new infrastructure and leverage encrypted HTTPS communications with valid server certificates when exfiltrating information from the victim\u2019s environment. The HTTPS exfiltration capability only uses two HTTP content types, defined in Table 4. Traffic associated with HTTPS exfiltration will use the URL scheme shown in Figure 7.
\n\n| \n \n \n\n \nContent Type \n | \n\n \n \n\n \nURL Path \n | \n
|---|---|
| \n \n \n\n \napplication/json \n | \n\n \n \n\n \n/v/p \n | \n
| \n \n \n\n \napplication/octet-stream \n | \n\n \n \n\n \n/v/d \n | \n
![\"Figure](\"/sites/default/files/styles/large/public/2026-07/Figure%207.png?itok=CdTcyMdN\")
\n\n\n\nSome of the data transmitted via HTTPS uses the standard JSON content type format. The script includes the information in a POST request to actor-controlled infrastructure.
\nTable 5 provides a summary of the JSON-based exfiltration.
\n\n| \n \n \n\n \nType of Information \n | \n\n \n \n\n \nExfiltration Stage \n | \n\n \n \n\n \nJSON Key(s) \n | \n
|---|---|---|
| \n \n \n\n \nVictim\u2019s Email Address \n | \n\n \n \n\n \ngather_email \n | \n\n \n \n\n \n | \n
| \n \n \n\n \nClient Type, Version, and Current URL \n | \n\n \n \n\n \ngather_environment \n | \n\n \n \n\n \nclient, version, full_url \n | \n
| \n \n \n\n \nNewly Created Application Password \n | \n\n \n \n\n \ngather_app_password \n | \n\n \n \n\n \napp_password \n | \n
| \n \n \n\n \nHarvested Autocomplete Password \n | \n\n \n \n\n \ngather_autocomplete_password \n | \n\n \n \n\n \nautocomplete_password \n | \n
The script transmits all HTTPS exfiltration not identified in Table 5 using the Octet-Stream content type as binary data. The POST requests for this method include a filename in the \u201cX-Filename\u201d header. Traditionally, developers use headers prefixed with \u201cX-\u201d to denote custom headers that do not follow a defined standard. The purpose of including this header remains unclear since the Catcher capability ignores the provided filename when saving the data. Table 6 summarizes the data exfiltrated in this format.
\n| \n \n \n\n \nType of Information \n | \n\n \n \n\n \nExfiltration Stage \n | \n\n \n \n\n \nX-Filename Header \n | \n
|---|---|---|
| \n \n \n\n \nSOAP request for GetInfoRequest \n | \n\n \n \n\n \ngather_environment \n | \n\n \n \n\n \nzimbra_batch_analytics.json \n | \n
| \n \n \n\n \nSOAP request for GetScratchCodesRequest \n | \n\n \n \n\n \ngather_2fa_codes \n | \n\n \n \n\n \nzimbra_batch_analytics.json \n | \n
| \n \n \n\n \nSOAP request for GetDeviceStatusRequest \n | \n\n \n \n\n \ngather_device_status \n | \n\n \n \n\n \nzimbra_batch_analytics.json \n | \n
| \n \n \n\n \nSOAP request for GetOAuthConsumersRequest \n | \n\n \n \n\n \ngather_oauth_consumers \n | \n\n \n \n\n \nzimbra_batch_analytics.json \n | \n
| \n \n \n\n \nVictim Organization\u2019s Global Address List \n | \n\n \n \n\n \ngather_gal \n | \n\n \n \n\n \ntelemetry_{1-20}.json \n | \n
| \n \n \n\n \nLast 90 Days of Victim\u2019s Emails \n | \n\n \n \n\n \nsendArchives \n | \n\n \n \n\n \ntelemetryData_{0-89}.json \n | \n
The script sends all exfiltrated data identified in Table 6 to the Catcher service exactly as received from the SOAP request in a JSON payload, except for email exfiltration. For email exfiltration, the script sends it as a GZIP compressed archive [T1560]. Although most of the exfiltration consists of valid JSON, the script still attempts to exfiltrate all information identified in Table 6 using the application/octet-stream content typing rather than application/json.
\nAt the beginning and end of the collection and exfiltration activity, during the sendStartPing and sendFinishPing stages respectively, the script submits a POST request with a JSON payload to indicate that the script is starting or finishing execution. Throughout execution, the script also logs error events and send the logs using similar JSON payloads. The script sends the JSON in a POST request to the URL documented in Figure 2, using a URL path of \u201c/v/p\u201d and with a \u201csubtype\u201d key that shows which type of action it logged (start, finish, or error).
\nUlej exfiltrates information to Flowerbed to be handled by a service named Catcher. Catcher is a containerized Python application, running in Docker as part of Flowerbed, which is detailed in the Resource development section. It receives exfiltrated data and temporarily stores it, enabling its eventual transfer to infrastructure designed for long-term, secure storage.
\nCatcher acts as an HTTP server over port 8000 and a DNS server on port 53. As described in the Resource development section, the Flowerbed project uses an additional Docker container running an Nginx reverse proxy to enable HTTPS support. This reverse proxy uses a certificate generated by Let\u2019s Encrypt and forwards all traffic with an SNI containing \u201c*.i.*\u201d to port 8000 within the Catcher container.
\nThe DNS service can accept A, AAAA, MX, TXT, and CAA queries. For any MX, AAAA, or CAA queries, the server will always provide an empty response. The system only supports TXT records as needed to process Automatic Certificate Management Environment (ACME) requests, which enable the assignment of Let\u2019s Encrypt certificates. If the server receives an A query, Catcher will always respond with the public IP address of the Flowerbed server.
\nHowever, if a query includes a domain formatted as shown in Figure 6 and Figure 7, the service saves a log file in JSON format to disk containing the following details of the DNS query:
\nThe HTTP server typically responds with OK, except in cases where the path is \u201cpixel.gif\u201d when the response contains a 1x1 gif image with a SHA-256 hash of ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629. Like the DNS service, the HTTP service will only log entries when the domain found in the host header of the request follows the expected formatting as seen in Figure 6 and Figure 7. As the HTTPS exfiltration uses non-standardized binary and JSON-formatted payloads when exfiltrating to Catcher, Catcher will check the content type of the request. If the content type is set to \u201capplication/json\u201d, Catcher encodes the data in Base64 and includes it in the JSON log entry written to disk. If the content type is set to any other value, Catcher leaves the Base64 payload in the JSON log entry blank and saves the payload to a separate file with the same filename as the JSON log entry with a \u201c.bin\u201d file extension. An HTTPS exfiltration event causes Catcher to save a JSON formatted log file to disk containing the following information from the HTTP request:
\nThese JSON event log files and binary output files are then initially saved to the directory /root/hits/tmp and later moved to the /root/hits/ready directory once processed. This prevents incomplete files, which are still being uploaded to Catcher, from premature exfiltration from the server. Approximately every 60 seconds, a likely automated workflow establishes a Secure Shell (SSH) connection with the server hosting Flowerbed for a few seconds, almost certainly exfiltrating the data processed by Catcher to non-public-facing infrastructure. The command in Figure 8 also executes hourly to remove all files last modified at least two days ago from the /root/hits/ready directory.
\n\n\n\n\n![\"Figure](\"/sites/default/files/styles/large/public/2026-07/Figure%208-Command%20used%20for%20automated%20directory%20cleanup.png?itok=IqvZvbLK\")
\n\n\n\nIn many cases, by the time an organization identifies a compromise related to this campaign, numerous sensitive and proprietary emails have already been exfiltrated. The significant risk posed by this cyber threat emphasizes the importance for organizations that use ZCS and other similar webmail solutions to take proactive steps to mitigate this risk.
\nAll organizations that use the ZCS webmail service should immediately prioritize ensuring that their ZCS is not running a vulnerable version. A patch for CVE-2025-66376 was released for both 10.1.13 and 10.0.18 versions of ZCS [D3-AH]. If immediate patching is not feasible, organizations should advise employees to use alternative mail clients to access email and avoid using the Classic ZCS webmail client until ZCS is updated to a non-vulnerable version [d3f:Isolate].
\nSystem administrators should closely monitor any Internet-connected ZCS or other email systems and the workstations that access those systems and promptly apply available software updates [D3-AH]. Administrators can maintain awareness of active vulnerability exploitation by referencing open source resources, including CISA\u2019s Known Exploited Vulnerabilities Catalog and NCSC-UK\u2019s Responding to active exploitation of vulnerabilities guidance.
\nOrganizations should consider using a third-party authentication service that supports passkeys for authentication to mediate access to ZCS and other services that do not natively support passkeys. By doing so, organizations can work to eliminate the possibility of automated password collection from autocomplete or password reuse [D3-CH]. However, Application Passcodes may still be necessary and should be monitored closely.
\nOrganizations should implement network monitoring capabilities with collection and short-term retention of packet capture or NetFlow data and maintain log collection and storage [CPG 3.Q]. This will allow organizations to monitor for and identify suspicious network activity [CPG 4.B], such as:
\nAdditionally, for organizations that can inspect the content of outbound HTTPS connections via break-and-inspect infrastructure, security teams should identify traffic matching the characteristics described in the Exfiltration section of this advisory.
\nThe following indicators have been attributed to use by LAUNDRY BEAR for their campaign targeting ZCS\u2019s webmail service as of the publication of this advisory. (Disclaimer: Due to the frequency of operational structure changes by this group, these indicators are intended solely for historic attribution purposes. Some indicators, such as IPs, compromised emails, and domains, may be outdated, so organizations should check for current activity before acting on these IOCs.) Table 7 provides details about the server infrastructure used to host Flowerbed, and Table 8 lists the corresponding SHA-1 hash values for the Let\u2019s Encrypt certificates used by that infrastructure [D3-IAA].
\n\n| \n \n \n\n \nDomain \n | \n\n \n \n\n \nIP Address \n | \n\n \n \n\n \nFirst Seen \n | \n\n \n \n\n \nLast Seen \n | \n
|---|---|---|---|
| \n \n \n\n \nzmailanalytics[.]com \n | \n\n \n \n\n \n216.252.238[.]104 \n | \n\n \n \n\n \n8 July 2025 \n | \n\n \n \n\n \n15 October 2025 \n | \n
| \n \n \n\n \nzimbra-metadata[.]com \n | \n\n \n \n\n \n216.252.238[.]18 \n | \n\n \n \n\n \n20 August 2025 \n | \n\n \n \n\n \n14 October 2025 \n | \n
| \n \n \n\n \nanalyticemailmeter[.]com \n | \n\n \n \n\n \n37.120.247[.]228 \n | \n\n \n \n\n \n24 September 2025 \n | \n\n \n \n\n \n18 March 2026 \n | \n
| \n \n \n\n \nemailanalytics.com[.]ua \n | \n\n \n \n\n \n185.86.79[.]95 \n | \n\n \n \n\n \n24 September 2025 \n | \n\n \n \n\n \n18 March 2026 \n | \n
| \n \n \n\n \nmailnalysis[.]com \n | \n\n \n \n\n \n104.248.134[.]194 \n | \n\n \n \n\n \n11 November 2025 \n | \n\n \n \n\n \n17 February 2026 \n | \n
| \n \n \n\n \nzimbrastat[.]com \n | \n\n \n \n\n \n64.226.124[.]190 \n | \n\n \n \n\n \n18 December 2025 \n | \n\n \n \n\n \n18 March 2026 \n | \n
| \n \n \n\n \nzimbrasoft.com[.]ua \n | \n\n \n \n\n \n193.238.152[.]66 \n | \n\n \n \n\n \n20 January 2026 \n | \n\n \n \n\n \n18 March 2026 \n | \n
| \n \n \n\n \nsynacorzimbra[.]nl \n | \n\n \n \n\n \n216.252.238[.]64 \n | \n\n \n \n\n \n3 February 2026 \n | \n\n \n \n\n \n30 March 2026 \n | \n
| \n \n \n\n \nistc-cloud[.]com \n | \n\n \n \n\n \n194.156.103[.]193 \n | \n\n \n \n\n \n5 February 2026 \n | \n\n \n \n\n \n30 March 2026 \n | \n
| \n \n \n\n \nAssociated Domain \n | \n\n \n \n\n \nX.509 SHA-1 Hash \n | \n\n \n \n\n \nFirst Seen \n | \n\n \n \n\n \nLast Seen \n | \n
|---|---|---|---|
| \n \n \n\n \nzmailanalytics[.]com \n | \n\n \n \n\n \n2e4f314bc9943cab5005d6fde0b271c74d47bc9d \n | \n\n \n \n\n \n8 Jul 2025 \n | \n\n \n \n\n \n6 Aug 2025 \n | \n
| \n \n \n\n \n*.i.zmailanalytics[.]com \n | \n\n \n \n\n \n50a87d926621dd06389ba50d86e0ff574ed713a8 \n | \n\n \n \n\n \n6 Aug 2025 \n | \n\n \n \n\n \n13 Oct 2025 \n | \n
| \n \n \n\n \n*.i.zimbra-metadata[.]com \n | \n\n \n \n\n \nc5a72420e7bb308d078e62128430897f82194c95 \n | \n\n \n \n\n \n20 Aug 2025 \n | \n\n \n \n\n \n14 Oct 2025 \n | \n
| \n \n \n\n \n*.i.analyticemailmeter[.]com \n | \n\n \n \n\n \n8959c4d29e29f02ea94ea8bb21c8df2594c5549d \n | \n\n \n \n\n \n24 Sep 2025 \n | \n\n \n \n\n \n8 Nov 2025 \n | \n
| \n \n \n\n \n*.i.emailanalytics.com[.]ua \n | \n\n \n \n\n \n62eb76432597694edb01c1fe57aab0cfe03a7178 \n | \n\n \n \n\n \n25 Sep 2025 \n | \n\n \n \n\n \n27 Sep 2025 \n | \n
| \n \n \n\n \n*.i.mailnalysis[.]com \n | \n\n \n \n\n \ncddf5c3be1e07f28140aed165b929bf2d614922a \n | \n\n \n \n\n \n12 Nov 2025 \n | \n\n \n \n\n \n17 Dec 2025 \n | \n
| \n \n \n\n \n*.i.zimbrastat[.]com \n | \n\n \n \n\n \n18b3ad442ce73cc8656d51d75bbd7c855f2cb7e8 \n | \n\n \n \n\n \n18 Dec 2025 \n | \n\n \n \n\n \n28 Dec 2025 \n | \n
| \n \n \n\n \n*.i.zimbrasoft.com[.]ua \n | \n\n \n \n\n \n1b25041ececf2457eef0270fc1d785cec8ec9ded \n | \n\n \n \n\n \n21 Jan 2026 \n | \n\n \n \n\n \n10 Feb 2026 \n | \n
| \n \n \n\n \n*.i.synacorzimbra[.]nl \n | \n\n \n \n\n \ne4fe6466a4f9a4249fe330651e914e45bbdca44a \n | \n\n \n \n\n \n5 Feb 2026 \n | \n\n \n \n\n \n22 Mar 2026 \n | \n
| \n \n \n\n \n*.i.istc-cloud[.]com \n | \n\n \n \n\n \nb6b77c9a455225d525834a403ca9ef5481ed0447 \n | \n\n \n \n\n \n12 Feb 2026 \n | \n\n \n \n\n \n30 Mar 2026 \n | \n
LAUNDRY BEAR has used the following email addresses to procure resources used for this campaign:
\nLAUNDRY BEAR primarily relied on ProtonMail for distribution of malicious email. However, as stated above, LAUNDRY BEAR\u2019s more recent efforts likely have shifted to distributing the payload through previous victims.
\nThe following email addresses have distributed payloads attributed to this campaign:
\nAdditionally, the following are SHA-256 hashes of email samples containing the malicious payload attributed to this campaign:
\nCurrently, the script does not remove artifacts. This leaves additional opportunities to identify victims of this activity. While emphasis should always be placed on consistent monitoring of network traffic and endpoint activity, there are a variety of persistent artifacts described below that can be used to identify victims of this campaign.
\nThis Ulej capability relies on creating a significant number of SOAP requests to collect account information for exfiltration. ZCS logs from these requests are stored, by default, in the /opt/zimbra/log/mailbox.log file [D3-PA]. A significant amount of SOAP request activity that aligns with what was described in the Persistence and credential access and Collection sections of this advisory could indicate a potential compromise. Specific examples of high-risk SOAP request activity might include:
\nWhile LAUNDRY BEAR uses the localStorage property to track what days had emails previously exfiltrated, defenders can use this property to identify victims of this campaign and determine the scope of exfiltrated information [D3-PA]. Review of the items stored in that property for an organization\u2019s ZCS webmail client page on an endpoint device could indicate compromise if there are items named with a format of zd_comp_YYYY-MM-DD, as explained in the Collection section of this advisory.
\nWhile Application Passcodes have non-malicious purposes, in this case instances of these passcodes with the name \u201cZimbraWeb\u201d are almost certainly malicious. The ZCS webmail application can support 2FA natively and does not require the use of an Application Passcode, so there is no reason that there should be one named \u201cZimbraWeb.\u201d
\nIn instances where organizations identify victims of this campaign, they should also examine the inbox of the suspected victim for the original phishing email [D3-MA]. If an email that has a payload exploiting CVE-2025-66376 is discovered, steps should be taken immediately to identify and quarantine other instances of emails with similar body content, senders, and subject lines to prevent further exploitation and exfiltration.
\nIn the event an organization identifies activity associated with this campaign, that organization should take steps to minimize further exploitation. The organization should consider requesting that employees minimize use of the ZCS webmail client until the organization updates to a patched version that is not vulnerable to CVE-2025-66376.
\nOrganizations should use identifiers from the IOCs section of this report to identify any individuals compromised by this campaign and record the date(s) of compromise(s) to determine the scale and scope of emails exfiltrated.
\nAll users from the organization should have all Application Passcodes and 2FA scratch keys revoked. Affected organizations should require all employees to change passwords in line with establishing minimum password strength requirements [CPG 3.B] and creating unique credentials [CPG 3.C], specifically noting that compromised employees might have had any password stored in a password manager exfiltrated.
\n[1] Netherlands General Intelligence and Security Service (AIVD) and Netherlands Defence Intelligence and Security Service (MIVD). AIVD and MIVD identify a new Russian cyber threat actor. 2025. https://www.aivd.nl/site/binaries/site-content/collections/documents/2025/05/27/aivd-en-mivd-onderkennen-nieuwe-russische-cyberactor/Advisory+AIVD+en+MIVD+Public+report+on+new+cyber+actor.pdf
\n[2] Microsoft Corporation. New Russia-affiliated actor Void Blizzard targets critical sectors for espionage. 2025. https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/
\n[3] Palo Alto Networks Unit 42. Russian Global Webmail Espionage. 2026. https://unit42.paloaltonetworks.com/russian-webmail-espionage/
\n[4] Proofpoint. TA488 Targets Zimbra Mailservers with Half-Click Exploits. 2026. https://www.proofpoint.com/us/blog/threat-insight/ta488-zcs-exploit
\n[5] Seqrite. Operation GhostMail: Russian APT exploits Zimbra Webmail to Target Ukraine State Agency. 2026. https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/
\n1 N\u00e1rodn\u00ed \u00fa\u0159ad pro kybernetickou a informa\u010dn\u00ed bezpe\u010dnost
2 Forsvarets Efterretningstjeneste
3 V\u00e4lisluureamet
4 Sotilastiedustelu
5 Suojelupoliisi
6 Direction g\u00e9n\u00e9rale de la s\u00e9curit\u00e9 int\u00e9rieure
7 Agence nationale de la s\u00e9curit\u00e9 des syst\u00e8mes d\u2019information
8 Agenzia Informazioni e Sicurezza Esterna
9 Agenzia Informazioni e Sicurezza Interna
10 Serviciul de Informa\u021bii \u0219i Securitate al Republicii Moldova
11 Agencja Wywiadu
12 S\u0142u\u017cba Kontrwywiadu Wojskowego
13 Centro Nacional de Inteligencia
14 Nationellt Cybers\u00e4kerhetscenter
15 MITRE and ATT&CK are registered trademarks of The MITRE Corporation. MITRE D3FEND is a trademark of The MITRE Corporation.
The authoring agencies acknowledge the contributions to this advisory from Palo Alto Networks Unit 42 and Proofpoint.
\nThe information and opinions contained in this document are provided \"as is\" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.
\nOrganizations have no obligation to respond or provide information back to the authoring organizations in response to this joint advisory. If, after reviewing the information provided, an organization decides to provide information to the authoring organizations, reporting must be consistent with all applicable laws and policies.
\nThis document was developed in furtherance of the authoring agencies\u2019 cybersecurity missions, including their responsibilities to identify and disseminate threats, and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.
\nUnited States organizations
\nDutch organizations
\nAustralian organizations
\nCanadian organizations
\nNew Zealand organizations
\nUnited Kingdom organizations
\nEstonia organizations
\nFinnish organizations
\nFrench organizations
\nItalian Organizations
\nMoldovan organizations
\nPolish organizations
\nSee Table 9 through Table 19 for all the threat actor tactics and techniques referenced in this advisory.
\n| \n \n \n\n \nTechnique Title \n | \n\n \n \n\n \nID \n | \n\n \n \n\n \nUse \n | \n
|---|---|---|
| \n \n \n\n \nGather Victim Identity Information: Credentials \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nThe payload attempts to intercept a victim\u2019s password from their password manager. \n | \n
| \n \n \n\n \nGather Victim Identity Information: Email Addresses \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nThe payload attempts to grab the victim\u2019s email address from various data stores. \n | \n
| \n \n \n\n \nSearch Open Websites/Domains \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nThis group likely leverages public information to support target development. \n | \n
| \n \n \n\n \nActive Scanning \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nPort scanning can be used by this group to assist with determining exploitability of identified targets. \n | \n
| \n \n \n\n \nSearch Open Technical Databases: Scan Databases \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nVarious public datasets can provide information to support discovery of exploitable targets. \n | \n
| \n \n \n\n \nSearch Closed Sources \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nPreviously exfiltrated data can be used to enhance target development efforts. \n | \n
| \n \n \n\n \nSearch Closed Sources: Purchase Technical Data \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nCommercial datasets can also be used to support target development efforts. \n | \n
| \n \n \n\n \nTechnique Title \n | \n\n \n \n\n \nID \n | \n\n \n \n\n \nUse \n | \n
|---|---|---|
| \n \n \n\n \nAcquire Infrastructure \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nThis group used Mullvad VPN to anonymize traffic sent to operational infrastructure. \n | \n
| \n \n \n\n \nAcquire Infrastructure: Virtual Private Server \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nThis group procured VPS servers from a variety of vendors. \n | \n
| \n \n \n\n \nDevelop Capabilities \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nThe Ulej capability was developed likely for use by this group to conduct spear phishing campaigns. \n | \n
| \n \n \n\n \nDevelop Capabilities: Malware \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nDevelopment of a novel payload that steals a victim\u2019s emails and other sensitive account information. \n | \n
| \n \n \n\n \nDevelop Capabilities: Exploits \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nDevelopment of a novel, at the time, cross-site-scripting (XSS) exploit that enables execution of arbitrary JavaScript. \n | \n
| \n \n \n\n \nObtain Capabilities: Tool \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nOpen source tools, such as Evilginx2, have also been used by the group. \n | \n
| \n \n \n\n \nObtain Capabilities: Artificial Intelligence \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nThe group appears to have leveraged AI to support development efforts. \n | \n
| \n \n \n\n \nStage Capabilities \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nFlowerbed is deployed to a procured server in the cloud. \n | \n
| \n \n \n\n \nTechnique Title \n | \n\n \n \n\n \nID \n | \n\n \n \n\n \nUse \n | \n
|---|---|---|
| \n \n \n\n \nValid Accounts \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nThis actor has used commercial datasets to acquire account credentials and gain unauthorized access to accounts. Additionally, this actor is believed to use previously compromised accounts to conduct spear phishing. \n | \n
| \n \n \n\n \nTrusted Relationship \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nThe group sends malicious payloads to targeted individuals using previously compromised accounts that might have an established relationship with the target. \n | \n
| \n \n \n\n \nPhishing \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nThe actors used spear phishing to lure users into opening malicious email. \n | \n
| \n \n \n\n \nTechnique Title \n | \n\n \n \n\n \nID \n | \n\n \n \n\n \nUse \n | \n
|---|---|---|
| \n \n \n\n \nExploitation for Client Execution \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nAn XSS vulnerability was leveraged to execute the JavaScript payload. \n | \n
| \n \n \n\n \nTechnique Title \n | \n\n \n \n\n \nID \n | \n\n \n \n\n \nUse \n | \n
|---|---|---|
| \n \n \n\n \nAccount Manipulation \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nEnabling IMAP and Application Passcodes provides persistent access to the compromised account. \n | \n
| \n \n \n\n \nModify Authentication Process: Multi-Factor Authentication \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nCreating Application Passcodes to bypass 2FA and stealing a user\u2019s \u201cScratch Keys,\u201d which can be used in place of a 2FA token. \n | \n
| \n \n \n\n \nTechnique Title \n | \n\n \n \n\n \nID \n | \n\n \n \n\n \nUse \n | \n
|---|---|---|
| \n \n \n\n \nValid Accounts \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nThis actor has used commercial datasets to acquire account credentials and gain unauthorized privileged access to accounts. \n | \n
| \n \n \n\n \nTechnique Title \n | \n\n \n \n\n \nID \n | \n\n \n \n\n \nUse \n | \n
|---|---|---|
| \n \n \n\n \nObfuscated Files or Information: Command Obfuscation \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nObfuscated JavaScript payload sent to targets to exploit the XSS vulnerability. \n | \n
| \n \n \n\n \nObfuscated Files or Information: Encrypted/Encoded File \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nThe JavaScript payload included both a Base64-encoded and XOR-encrypted inner payload. \n | \n
| \n \n \n\n \nObfuscated Files or Information: SVG Smuggling \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nThe payload was contained in an \u201conload\u201d attribute within an SVG image included in the malicious email. \n | \n
| \n \n \n\n \nUse Alternate Authentication Material: Web Session Cookie \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nPrevious campaigns using AiTM leveraged stealing and use of a victim\u2019s session cookies to authenticate. \n | \n
| \n \n \n\n \nTechnique Title \n | \n\n \n \n\n \nID \n | \n\n \n \n\n \nUse \n | \n
|---|---|---|
| \n \n \n\n \nModify Authentication Process: Multi-Factor Authentication \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nCreating Application Passcodes to bypass 2FA and stealing a user\u2019s \u201cScratch Keys,\u201d which can be used in place of a 2FA token. \n | \n
| \n \n \n\n \nAdversary-in-the-Middle \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nPrevious campaigns used Evilginx2 as an AiTM toolkit to intercept credentials and session cookies. \n | \n
| \n \n \n\n \nTechnique Title \n | \n\n \n \n\n \nID \n | \n\n \n \n\n \nUse \n | \n
|---|---|---|
| \n \n \n\n \nData Staged: Remote Data Staging \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nExfiltrated data was sent to an actor-controlled VPS prior to assumed long-term storage solutions. \n | \n
| \n \n \n\n \nEmail Collection \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nThis group has emphasized collection of emails. \n | \n
| \n \n \n\n \nEmail Collection: Remote Email Collection \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nEmails are collected via API calls to the ZCS mail server and are not collected from emails stored directly on the victim\u2019s device. \n | \n
| \n \n \n\n \nAutomated Collection \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nUpon execution, the JavaScript payload automatically collects all relevant information in stages. \n | \n
| \n \n \n\n \nBrowser Session Hijacking \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nThe JavaScript payload leverages the user\u2019s authenticated browser session to make API requests as the user. \n | \n
| \n \n \n\n \nArchive Collected Data \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nEmails are exfiltrated with GZIP compression. \n | \n
| \n \n \n\n \nTechnique Title \n | \n\n \n \n\n \nID \n | \n\n \n \n\n \nUse \n | \n
|---|---|---|
| \n \n \n\n \nAccount Discovery \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nStolen Global Access Lists provide the group with new users to target. \n | \n
| \n \n \n\n \nTechnique Title \n | \n\n \n \n\n \nID \n | \n\n \n \n\n \nUse \n | \n
|---|---|---|
| \n \n \n\n \nExfiltration Over Alternative Protocol \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nVictim information was exfiltrated over both HTTPS and DNS. \n | \n
| \n \n \n\n \nExfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nSome payloads, especially ones with large amounts of data, were exfiltrated over HTTPS. \n | \n
| \n \n \n\n \nExfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nSome smaller bandwidth payloads were exfiltrated over DNS using Base32 encoding. \n | \n
See Table 20 for a mapping of several of the cybersecurity countermeasures mentioned in this advisory.
\n| \n \n \n\n \nCountermeasure Title \n | \n\n \n \n\n \nID \n | \n\n \n \n\n \nDescription \n | \n
|---|---|---|
| \n \n \n\n \nApplication Hardening \n | \n\n \n \n\n\n \n | \n\n \n \n\n \n
| \n
| \n \n \n\n \nIsolate \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nOrganizations that cannot feasibly patch should use alternative mail clients. \n | \n
| \n \n \n\n \nCredential Hardening \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nOrganizations should consider using a third-party authentication service that supports passkeys to mediate access to ZCS and other services that do not natively support passkeys. \n | \n
| \n \n \n\n \nNetwork Traffic Analysis \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nOrganizations should monitor for significant amounts of outbound data being sent to IPs associated with VPS providers not used by the organization. \n | \n
| \n \n \n\n \nDNS Traffic Analysis \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nOrganizations should monitor for frequent DNS queries to a suspicious domain for seemingly random subdomains. \n | \n
| \n \n \n\n \nNetwork Traffic Community Deviation \n | \n\n \n \n\n\n \n | \n\n \n \n\n \n
| \n
| \n \n \n\n \nIdentifier Activity Analysis \n | \n\n \n \n\n\n \n | \n\n \n \n\n \nOrganizations should search for the listed known IOCs. \n | \n
| \n \n \n\n \nProcess Analysis \n | \n\n \n \n\n\n \n | \n\n \n \n\n \n
| \n
| Message Analysis | \nD3-MA | \nOrganizations that suspect they have victims of this campaign should search for emails with a malicious payload to identify other victims. | \n
Successful exploitation of this vulnerability could result in an attacker obtaining confidential information from the device.
\nThe following versions of Johnson Controls XAAP Android are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 3.3 | \nJohnson Controls | \nJohnson Controls XAAP Android | \nCleartext Storage of Sensitive Information | \n
A cleartext storage weakness exists in the Fire Solutions Android application, which stores application data locally on the device without encryption. An attacker with physical access to the device and one able to compromise the device through a separate, unrelated flaw, could potentially read this data in plaintext. Exploitation does not require network access and is limited to the local device environment.
\n\nVendor fix
Johnson Controls recommends users update the XAAP Android application to version 1.53 or later, which contains the fix for this vulnerability.
Mitigation
Johnson Controls recommends users restrict physical access to devices running the XAAP Android application.
Mitigation
Johnson Controls recommends users ensure devices are hardened with up-to-date Android OS versions, device encryption enabled, and screen lock protections in place.
Mitigation
Johnson Controls recommends users implement a Mobile Device Management (MDM) solution to enforce security policies, including encryption requirements, application whitelisting, and remote wipe capabilities.
Mitigation
Johnson Controls recommends users Avoid rooting or jailbreaking devices used in production environments, as this weakens OS-level security controls that help protect local application data.
Mitigation
For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-10.
Relevant CWE: CWE-312 Cleartext Storage of Sensitive Information
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n3.3 | \nLOW | \nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | \n
| 4.0 | \n4.8 | \nMEDIUM | \nCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-23 | \n1 | \nInitial Republication of Johnson Controls JCI-PSA-2026-10 | \n
Successful exploitation of these vulnerabilities could allow an unauthenticated network-adjacent attacker to crash critical IEC 61850 services or execute arbitrary code, disrupting or compromising protection, visibility, and control functions.
\nThe following versions of MZ Automation libIEC61850 are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 8.1 | \nMZ Automation | \nMZ Automation libIEC61850 | \nStack-based Buffer Overflow, Heap-based Buffer Overflow, Improper Handling of Syntactically Invalid Structure, NULL Pointer Dereference | \n
The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to cause a memory corruption via a ReadRequest.
\n\nVendor fix
MZ Automation recommends updating to the latest build of the libIEC61850 standard. Documentation can be found at https://github.com/mz-automation/libiec61850.
https://github.com/mz-automation/libiec61850
Relevant CWE: CWE-121 Stack-based Buffer Overflow
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | \n
The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution (RCE) has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled.
\n\nVendor fix
MZ Automation recommends updating to the latest build of the libIEC61850 standard. Documentation can be found at https://github.com/mz-automation/libiec61850.
https://github.com/mz-automation/libiec61850
Relevant CWE: CWE-122 Heap-based Buffer Overflow
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.1 | \nHIGH | \nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
| 4.0 | \n9.2 | \nCRITICAL | \nCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value.
\n\nVendor fix
MZ Automation recommends updating to the latest build of the libIEC61850 standard. Documentation can be found at https://github.com/mz-automation/libiec61850.
https://github.com/mz-automation/libiec61850
Relevant CWE: CWE-228 Improper Handling of Syntactically Invalid Structure
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
| 4.0 | \n7.1 | \nHIGH | \nCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | \n
A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequest with an empty listOfData field.
\n\nVendor fix
MZ Automation recommends updating to the latest build of the libIEC61850 standard. Documentation can be found at https://github.com/mz-automation/libiec61850.
https://github.com/mz-automation/libiec61850
Relevant CWE: CWE-476 NULL Pointer Dereference
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-23 | \n1 | \nInitial Publication | \n
Successful exploitation of this vulnerability could cause the parsing process to crash, which will cause a denial of service.
\nThe following versions of MZ Automation lib60870 are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 8.2 | \nMZ Automation | \nMZ Automation lib60870 | \nOut-of-bounds Read | \n
The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash the parsing process and cause a denial of service.
\n\nVendor fix
MZ automation recommends users update to version 2.4.1 or later. Documentation can be found at https://github.com/mz-automation/lib60870/security/advisories/GHSA-f5xp-w6f3-vvrv.
https://github.com/mz-automation/lib60870/security/advisories/GHSA-f5xp-w6f3-vvrv
Relevant CWE: CWE-125 Out-of-bounds Read
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.2 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H | \n
| 4.0 | \n8.8 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this (these) vulnerability(ies).
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-23 | \n1 | \nInitial Publication | \n
Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution.
\nThe following versions of Johnson Controls C-CURE 9000 and Victor application server are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 9.6 | \nJohnson Controls | \nJohnson Controls C-CURE 9000 and Victor application server | \nServer-Side Request Forgery (SSRF), Execution with Unnecessary Privileges | \n
Under certain circumstances, successful exploitation of this vulnerability could allow an unauthenticated attacker on the adjacent network to achieve arbitrary code execution on the C-CURE 9000 or victor application server, as well as connected clients (e.g., workstations of physical security personnel). Such an attack could impact physical security controls.
\n\nMitigation
Johnson Controls recommends the following defensive measures to help reduce the risk of exploitation: (CVE-2026-21655) Upgrade to C-CURE 9000 / victor version 3.20 or later, which addresses the vulnerable deserialization path (LV1.1).
Vendor fix
Network segmentation - Isolate the C-CURE 9000 and victor application servers on a dedicated network segment and restrict access to port 8999 to only authorized systems that require connectivity.
Mitigation
Firewall / access control lists - Implement strict firewall rules to block all unnecessary inbound connections to port 8999 from untrusted network segments.
Mitigation
Intrusion detection / prevention - Deploy IDS/IPS signatures tuned to detect known .NET deserialization exploit payloads (e.g., ysoserial.net patterns) targeting port 8999.
Mitigation
Application whitelisting - Enforce application whitelisting on application server hosts to prevent unauthorized executables from being launched by the server process.
Mitigation
Least privilege - Ensure the application server process runs with the minimum privileges necessary, reducing the impact of successful exploitation.
Mitigation
Monitor and audit - Enable detailed logging on application server hosts and monitor for anomalous process creation by SoftwareHouse.CrossFire.Server.exe.
Mitigation
Disable unnecessary services - If the ClientConnectionManager_NF.SynchronousServerNotification callback interface is not required, disable or restrict it to reduce attack surface.
Mitigation
For more detailed mitigation instructions, please see Johnson Controls Product Security Advisories JCI-PSA-2026-07, JCI-PSA-2026-13, and JCI-PSA-2026-16 at the following location: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
Relevant CWE: CWE-918 Server-Side Request Forgery (SSRF)
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
Under certain circumstances, successful exploitation of this vulnerability could allow an attacker to forge server-side HTTP requests from the victor Web application. This could be leveraged to interact with internal services running on the host or accessible on the local network, potentially leading to unauthorized information disclosure or lateral movement within the network.
\n\nVendor fix
(CVE-2026-21653, CVE-2026-34496) Update all victor Web installations to version 7.0 or later, which contains the fix for this vulnerability. The fix has been validated through independent retest.
Mitigation
Firewall / access control lists - Implement strict firewall rules to block all unnecessary inbound connections to port 8999 from untrusted network segments.
Mitigation
Intrusion detection / prevention - Deploy IDS/IPS signatures tuned to detect known .NET deserialization exploit payloads (e.g., ysoserial.net patterns) targeting port 8999.
Mitigation
Application whitelisting - Enforce application whitelisting on application server hosts to prevent unauthorized executables from being launched by the server process.
Mitigation
Least privilege - Ensure the application server process runs with the minimum privileges necessary, reducing the impact of successful exploitation.
Mitigation
Monitor and audit - Enable detailed logging on application server hosts and monitor for anomalous process creation by SoftwareHouse.CrossFire.Server.exe.
Mitigation
Disable unnecessary services - If the ClientConnectionManager_NF.SynchronousServerNotification callback interface is not required, disable or restrict it to reduce attack surface.
Mitigation
For more detailed mitigation instructions, please see Johnson Controls Product Security Advisories JCI-PSA-2026-07, JCI-PSA-2026-13, and JCI-PSA-2026-16 at the following location: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
Relevant CWE: CWE-918 Server-Side Request Forgery (SSRF)
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.6 | \nCRITICAL | \nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | \n
| 4.0 | \n9.4 | \nCRITICAL | \nCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | \n
Under certain circumstances, successful exploitation of this vulnerability could result in low privilege users accessing unauthorized pages such as Users and Logs. Successful exploitation could allow an attacker to view sensitive system information, user account details, and audit logs beyond their intended access level, potentially enabling further attacks or unauthorized administrative actions.
\n\nVendor fix
(CVE-2026-21653, CVE-2026-34496) Update all victor Web installations to version 7.0 or later, which contains the fix for this vulnerability. The fix has been validated through independent retest.
Mitigation
Firewall / access control lists - Implement strict firewall rules to block all unnecessary inbound connections to port 8999 from untrusted network segments.
Mitigation
Intrusion detection / prevention - Deploy IDS/IPS signatures tuned to detect known .NET deserialization exploit payloads (e.g., ysoserial.net patterns) targeting port 8999.
Mitigation
Application whitelisting - Enforce application whitelisting on application server hosts to prevent unauthorized executables from being launched by the server process.
Mitigation
Least privilege - Ensure the application server process runs with the minimum privileges necessary, reducing the impact of successful exploitation.
Mitigation
Monitor and audit - Enable detailed logging on application server hosts and monitor for anomalous process creation by SoftwareHouse.CrossFire.Server.exe.
Mitigation
Disable unnecessary services - If the ClientConnectionManager_NF.SynchronousServerNotification callback interface is not required, disable or restrict it to reduce attack surface.
Mitigation
For more detailed mitigation instructions, please see Johnson Controls Product Security Advisories JCI-PSA-2026-07, JCI-PSA-2026-13, and JCI-PSA-2026-16 at the following location: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
Relevant CWE: CWE-250 Execution with Unnecessary Privileges
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8 | \nHIGH | \nCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-23 | \n1 | \nInitial Republication of Johnson Controls Product Security Advisories JCI-PSA-2026-07, JCI-PSA-2026-13, and JCI-PSA-2026-16 | \n
Successful exploitation of these vulnerabilities could allow an attacker with access to the IT network to manipulate industrial control devices without requiring physical access, specialized insider knowledge, or advanced tooling.
\nThe following versions of Panduit IntraVUE are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 10 | \nPronetiqs | \nPanduit IntraVUE | \nPlaintext Storage of a Password, Unintended Proxy or Intermediary ('Confused Deputy'), Exposure of Sensitive System Information to an Unauthorized Control Sphere, Inadequate Encryption Strength | \n
Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API.
\n\nVendor fix
Pronetiqs advises users to update to the latest version of the IntraVUE software, version 3.2.1a16 or later.
Mitigation
For further questions, please contact Pronetiqs at info@pronetiqs.com.
mailto:info@pronetiqs.com
Relevant CWE: CWE-256 Plaintext Storage of a Password
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | \n
Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, which would bypass OT segmentation.
\n\nVendor fix
Pronetiqs advises users to update to the latest version of the IntraVUE software, version 3.2.1a16 or later.
Mitigation
For further questions, please contact Pronetiqs at info@pronetiqs.com.
mailto:info@pronetiqs.com
Relevant CWE: CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n10 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | \n
| 4.0 | \n10 | \nCRITICAL | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | \n
Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could allow for asset discovery by unauthenticated users.
\n\nVendor fix
Pronetiqs advises users to update to the latest version of the IntraVUE software, version 3.2.1a16 or later.
Mitigation
For further questions, please contact Pronetiqs at info@pronetiqs.com.
mailto:info@pronetiqs.com
Relevant CWE: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.3 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | \n
| 4.0 | \n6.9 | \nMEDIUM | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | \n
Pronetiqs IntraVUE versions 3.2.1a14 and prior have an inadequate encryption strength vulnerability which could allow an attacker to steal admin credentials via weak hash or a pass-the-hash attack.
\n\nVendor fix
Pronetiqs advises users to update to the latest version of the IntraVUE software, version 3.2.1a16 or later.
Mitigation
For further questions, please contact Pronetiqs at info@pronetiqs.com.
mailto:info@pronetiqs.com
Relevant CWE: CWE-326 Inadequate Encryption Strength
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.8 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N | \n
| 4.0 | \n7.6 | \nHIGH | \nCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | \n
Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could expose the underlying host/share filesystem.
\n\nVendor fix
Pronetiqs advises users to update to the latest version of the IntraVUE software, version 3.2.1a16 or later.
Mitigation
For further questions, please contact Pronetiqs at info@pronetiqs.com.
mailto:info@pronetiqs.com
Relevant CWE: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.6 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N | \n
| 4.0 | \n9.2 | \nCRITICAL | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-23 | \n1 | \nInitial Publication | \n
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
", "summary_is_html": true, "first_seen": "Wed, 22 Jul 26 12:00:00 +0000", "last_updated": "Wed, 22 Jul 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-08", "title": "Rockwell Automation 1718-AENTR/1719-AENTR", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-08", "summary": "\nSuccessful exploitation of this vulnerability could allow for an attacker to cause a denial-of-service condition on the product.
\nThe following versions of Rockwell Automation 1718-AENTR/1719-AENTR are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.5 | \nRockwell Automation | \nRockwell Automation 1718-AENTR/1719-AENTR | \nAllocation of Resources Without Limits or Throttling | \n
A denial-of-service security issue exists in the 1719-AENTR. The security issue stems from improper handling of a UDP unicast network storm, which causes the device to become overloaded and lose communication. A power cycle is required to recover.
\n\nVendor fix
Rockwell Automation recommends users to upgrade to 1718/ 1719 Ex I/O version 3.012 or later.
Mitigation
Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight).
https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight
Mitigation
For more information, see Rockwell Automation Security Advisories: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html.
https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html
Relevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-21 | \n1 | \nInitial Republication of Rockwell Automation Security Advisory | \n
SIDIS Secured SmartPlug before V7.26.0310 is affected by multiple vulnerabilities in the components OpenSSL, OpenSSH, and several other packages as described below. Siemens has released a new version of SIDIS Secured SmartPlug and recommends to update to the latest version.
\nThe following versions of Siemens SIDIS Secured SmartPlug are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 9.8 | \nSiemens | \nSiemens SIDIS Secured SmartPlug | \nImproper Enforcement of Message Integrity During Transmission in a Communication Channel, Reusing a Nonce, Key Pair in Encryption, Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Integer Overflow or Wraparound, Out-of-bounds Read, Covert Timing Channel, Detection of Error Condition Without Action, Incorrect Authorization | \n
The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494.
\n\nVendor fix
Update to V7.26.0310 or later version
Relevant CWE: CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495.
\n\nVendor fix
Update to V7.26.0310 or later version
Relevant CWE: CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7 | \nHIGH | \nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This will result in the public ephemeral key X; the only element required to subvert the PKEX association.
\n\nVendor fix
Update to V7.26.0310 or later version
Relevant CWE: CWE-323 Reusing a Nonce, Key Pair in Encryption
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | \n
There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.
\n\nVendor fix
Update to V7.26.0310 or later version
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.
\n\nVendor fix
Update to V7.26.0310 or later version
Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7 | \nHIGH | \nCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.
\n\nVendor fix
Update to V7.26.0310 or later version
Relevant CWE: CWE-190 Integer Overflow or Wraparound
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.
\n\nVendor fix
Update to V7.26.0310 or later version
Relevant CWE: CWE-125 Out-of-bounds Read
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
Issue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an attacker.. While remote key recovery over a network was not attempted by the reporter, timing measurements revealed a timing signal which may allow such an attack. OpenSSL does not directly support certificates with SM2 keys in TLS, and so this CVE is not relevant in most TLS contexts. However, given that it is possible to add support for such certificates via a custom provider, coupled with the fact that in such a custom provider context the private key may be recoverable via remote timing measurements, we consider this to be a Moderate severity issue. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as SM2 is not an approved algorithm.
\n\nVendor fix
Update to V7.26.0310 or later version
Relevant CWE: CWE-385 Covert Timing Channel
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L | \n
Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.
\n\nVendor fix
Update to V7.26.0310 or later version
Relevant CWE: CWE-125 Out-of-bounds Read
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.9 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
\n\nVendor fix
Update to V7.26.0310 or later version
Relevant CWE: CWE-390 Detection of Error Condition Without Action
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.8 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N | \n
Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.
\n\nVendor fix
Update to V7.26.0310 or later version
Relevant CWE: CWE-863 Incorrect Authorization
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n2.8 | \nLOW | \nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N | \n
A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.
\n\nVendor fix
Update to V7.26.0310 or later version
Relevant CWE: CWE-190 Integer Overflow or Wraparound
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | \n
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-585531 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-14 | \n1 | \nPublication Date | \n
| 2026-07-21 | \n2 | \nInitial CISA Republication of Siemens ProductCERT SSA-585531 advisory | \n
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
", "summary_is_html": true, "first_seen": "Tue, 21 Jul 26 12:00:00 +0000", "last_updated": "Tue, 21 Jul 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-05", "title": "Siemens IAM Client", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-05", "summary": "\nMultiple Siemens products are affected by unquoted search path vulnerability in IAM Client. This could allow an authenticated local attacker to perform privilege escalation. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.
\nThe following versions of Siemens IAM Client are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 6.7 | \nSiemens | \nSiemens IAM Client | \nUntrusted Search Path | \n
Untrusted search path in IAM Client SDK may allow an authenticated user to potentially enable escalation of privilege via local access.
\n\nVendor fix
Update to V10.6.1 or later version
https://support.sw.siemens.com/product/222981661/
Vendor fix
Update to V225.0 Update 13 or later version
https://support.sw.siemens.com/product/246738425/
Vendor fix
Update to V226.0 Update 04 or later version
https://support.sw.siemens.com/product/246738425/
Vendor fix
Update to V2404.0022 or later version
https://support.sw.siemens.com/product/297028302/
Vendor fix
Update to V2412.0012 or later version
https://support.sw.siemens.com/product/229029598/
Vendor fix
Update to V2504.0010 or later version
https://support.sw.siemens.com/product/297028302/
Vendor fix
Update to V2506.0003 or later version
https://support.sw.siemens.com/product/275652363/
Vendor fix
Update to V2506.0009 or later version
https://support.sw.siemens.com/product/229029598/
Vendor fix
Update to V2512.0002 or later version
https://support.sw.siemens.com/product/275652363/
Vendor fix
Update to V2512.2605 or later version
https://support.sw.siemens.com/product/229029598/
Vendor fix
Update to V2512.7000 or later version
https://support.sw.siemens.com/product/209349590/
Vendor fix
Update to V2512.7000 or later version
https://support.sw.siemens.com/product/289054037/
Vendor fix
Update to V2606 or later version
https://support.sw.siemens.com/product/289054037/
Vendor fix
Update to V10.4.5.0.2 or later version. Contact customer support to receive patch and update information
Relevant CWE: CWE-426 Untrusted Search Path
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.7 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | \n
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-288252 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-14 | \n1 | \nPublication Date | \n
| 2026-07-21 | \n2 | \nInitial CISA Republication of Siemens ProductCERT SSA-288252 advisory | \n
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Customers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications. [1] https://security.paloaltonetworks.com/
\nThe following versions of Siemens RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.2 | \nSiemens | \nSiemens RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW | \nImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Missing Authorization, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | \n
A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS\u00ae software enables a malicious authenticated administrator to store a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma\u00ae Access are not affected by this vulnerability.
\n\nVendor fix
Contact customer support to receive patch and update information
Relevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n2.4 | \nLOW | \nCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N | \n
A privilege escalation vulnerability in Palo Alto Networks PAN-OS\u00ae software allows an authenticated administrator with access to the Command Line Interface (CLI) to perform actions on the device with root privileges. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW, and Prisma\u00ae Access are not impacted by this vulnerability.
\n\nVendor fix
Contact customer support to receive patch and update information
Relevant CWE: CWE-862 Missing Authorization
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N | \n
A command injection vulnerability in Palo Alto Networks PAN-OS\u00ae software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma\u00ae Access are not affected by this vulnerability.
\n\nVendor fix
Contact customer support to receive patch and update information
Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.2 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | \n
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-104023 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-14 | \n1 | \nPublication Date | \n
| 2026-07-21 | \n2 | \nInitial CISA Republication of Siemens ProductCERT SSA-104023 advisory | \n
Successful exploitation of this vulnerability could allow for an attacker to cause a denial-of-service condition on the product.
\nThe following versions of Rockwell Automation 1734 POINT I/O are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.5 | \nRockwell Automation | \nRockwell Automation 1734 POINT I/O | \nAllocation of Resources Without Limits or Throttling | \n
A denial-of-service security issue exists in 1734 POINT I/O module. The security issue stems from improper handling of crafted CIP messages, which can cause the module to enter a faulted state. A restart is required to recover.
\n\nMitigation
Rockwell Automation recommends users are to migrate to 5034-OB8.
Mitigation
Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight).
https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight
Mitigation
For more information, see Rockwell Automation Security Advisories: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html.
https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html
Relevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-21 | \n1 | \nInitial Republication of Rockwell Automation Security Advisory | \n
Successful exploitation of this vulnerability could allow an attacker to impersonate an authorized user on the FTSP server, resulting in unauthorized access to system configurations.
\nThe following versions of Rockwell Automation FactoryTalk Services Platform are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.8 | \nRockwell Automation | \nRockwell Automation FactoryTalk Services Platform | \nWeak Authentication | \n
A security issue exists within FactoryTalk Services Platform (FTSP), allowing an attacker to bypass JWT signature validation during Okta Web Authentication. The vulnerability stems from the application not verifying that the JWT algorithm is configured for RSA, enabling an attacker to set the algorithm to \"none\" and craft forged tokens. This could allow an authenticated low-privilege user to impersonate any authorized user on the FTSP server, resulting in unauthorized access to system configuration and the ability to grant permissions to other systems protected by FTSP.
\n\nMitigation
Users using FactoryTalk Services Platform v6.60 should apply either the individual patch (RAID 1158263) or the February 2026 Patch Roll-up, or later update.
Mitigation
Users using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell's security best practices.
https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight
Mitigation
For more information, refer to Rockwell Automation's security advisory SD1786 page.
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1786.html
Relevant CWE: CWE-1390 Weak Authentication
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H | \n
| 4.0 | \n8.8 | \nHIGH | \nCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-21 | \n1 | \nInitial Republication of Rockwell Automation SD1786 | \n
Successful exploitation of these vulnerabilities could allow for a local attacker to execute arbitrary files, alter configurations, or execute arbitrary code.
\nThe following versions of Rockwell Automation Studio 5000 Logix Designer are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.5 | \nRockwell Automation | \nRockwell Automation Studio 5000 Logix Designer | \nImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Incorrect Authorization, Unquoted Search Path or Element | \n
A path traversal security issue exists within Studio 5000 Logix Designer due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during the project opening procedure, allowing path traversal sequences to escape the intended extraction directory. If exploited, an attacker could craft a malicious ACD project file that results in arbitrary files being written to attacker-controlled locations on the file system, potentially leading to code execution.
\n\nVendor fix
Rockwell Automation recommends users to upgrade to the following: Studio 5000 Logix Designer: V37.00, 36.01, 35.02, 34.04, 33.04, 32.05 (CVE-2026-9108)
Mitigation
Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight).
https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight
Mitigation
For more information, see Rockwell Automation Security Advisories: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html.
https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html
Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.7 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H | \n
| 4.0 | \n5.4 | \nMEDIUM | \nCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
A remote code execution security issue exists within Studio 5000 Logix Designer due to incorrect authorization on a configuration file. This can allow any authenticated user to modify the paths of external tools configured within the application. If exploited, an attacker could alter the configuration to point to a malicious executable, resulting in arbitrary code execution when any user interacts with the external tools functionality.
\n\nVendor fix
Studio 5000 Logix Designer: V36.00, 35.01, 34.02, 33.02, 32.05 (CVE-2026-9127)
Mitigation
Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight).
https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight
Mitigation
For more information, see Rockwell Automation Security Advisories: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html.
https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html
Relevant CWE: CWE-863 Incorrect Authorization
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H | \n
| 4.0 | \n7.3 | \nHIGH | \nCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | \n
A code execution security issue exists within Studio 5000 Logix Designer due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these paths contain spaces, the operating system may resolve them to unintended executables placed earlier in the search order. If exploited, an attacker could plant a malicious executable in a location within the search path, resulting in arbitrary code execution with the same permissions of the user running the application.
\n\nVendor fix
Studio 5000 Logix Designer: V36.00, 35.01, 34.03, 33.03, 32.05 (CVE-2026-9128)
Mitigation
Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight).
https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight
Mitigation
For more information, see Rockwell Automation Security Advisories: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html.
https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html
Relevant CWE: CWE-428 Unquoted Search Path or Element
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H | \n
| 4.0 | \n7.3 | \nHIGH | \nCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities have a high attack complexity.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-21 | \n1 | \nInitial Republication of Rockwell Automation Security Advisory | \n
CADRA is affected by multiple zlib and Foxit vulnerabilities. Siemens has released a new version for CADRA and recommends to update to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
\nThe following versions of Siemens CADRA are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 9.8 | \nSiemens | \nSiemens CADRA | \nImproper Input Validation, Incorrect Bitwise Shift of Integer, Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Integer Overflow or Wraparound, Access of Resource Using Incompatible Type ('Type Confusion') | \n
zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.
\n\nVendor fix
Update to V2511 or later version
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.3 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | \n
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
\n\nVendor fix
Update to V2511 or later version
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
\n\nVendor fix
Update to V2511 or later version
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.
\n\nVendor fix
Update to V2511 or later version
Relevant CWE: CWE-1335 Incorrect Bitwise Shift of Integer
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value for the windowBits parameter.
\n\nVendor fix
Update to V2511 or later version
Relevant CWE: CWE-20 Improper Input Validation
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.0 | \n7.5 | \nHIGH | \nCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
\n\nVendor fix
Update to V2511 or later version
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).
\n\nVendor fix
Update to V2511 or later version
Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.
\n\nVendor fix
Update to V2511 or later version
Relevant CWE: CWE-190 Integer Overflow or Wraparound
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
\n\nMitigation
Block access to untrusted or external web content from sensitive systems
None available
Currently no fix is available
Relevant CWE: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
\n\nMitigation
Block access to untrusted or external web content from sensitive systems
None available
Currently no fix is available
Relevant CWE: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.
\n\nNone available
Currently no fix is available
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n0 | \nNONE | \nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N | \n
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-470355 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-14 | \n1 | \nPublication Date | \n
| 2026-07-21 | \n2 | \nInitial CISA Republication of Siemens ProductCERT SSA-470355 advisory | \n
Opcenter X before V2604 contain an authentication bypass vulnerability that could allow an attacker to gain full unauthorized access to the application. Siemens has released a new version for Opcenter X and recommends to update to the latest version.
\nThe following versions of Siemens Opcenter X are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 10 | \nSiemens | \nSiemens Opcenter X | \nImproper Verification of Cryptographic Signature | \n
Affected applications do not properly validate the algorithm specified in the JSON Web Token (JWT) header. This could allow an unauthenticated remote attacker to forge arbitrary JWT, bypass authentication mechanisms and impersonate any user including administrative accounts, potentially gaining full unauthorized access to the application.
\n\nVendor fix
Update to V2604 or later version
https://support.sw.siemens.com/product/206159703/
Relevant CWE: CWE-347 Improper Verification of Cryptographic Signature
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n10 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | \n
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-096828 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-14 | \n1 | \nPublication Date | \n
| 2026-07-21 | \n2 | \nInitial CISA Republication of Siemens ProductCERT SSA-096828 advisory | \n
Successful exploitation of these vulnerabilities could result in an attacker accessing sensitive credentials, disrupting connected infrastructure, or manipulating physical equipment, which could present a physical safety risk.
\nThe following versions of Tycon Systems TPDIN-Monitor-WEB2 are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 9.8 | \nTycon Systems | \nTycon Systems TPDIN-Monitor-WEB2 | \nAuthentication Bypass Using an Alternate Path or Channel, Cleartext Storage of Sensitive Information | \n
The web management interface of the affected device does not perform server-side validation of credentials during the login process. By submitting empty values for both credential fields, an unauthenticated remote attacker can bypass the authentication check and establish a valid administrative session. This grants full access to device controls including power relay management, device reboot, remote access service configuration, and network settings, which could allow an attacker to disrupt connected infrastructure or cause physical damage to equipment.
\n\nVendor fix
Tycon Systems did not respond to CISA's attempts at coordination. Users of Tycon Systems TPDIN-Monitor-WEB2 are encouraged to contact Tycon Systems and keep their systems up to date.
https://www.tyconsystems.com/contact
Relevant CWE: CWE-288 Authentication Bypass Using an Alternate Path or Channel
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
| 4.0 | \n9.3 | \nCRITICAL | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
The device's web management interface stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used to compromise other systems on the local network.
\n\nVendor fix
Tycon Systems did not respond to CISA's attempts at coordination. Users of Tycon Systems TPDIN-Monitor-WEB2 are encouraged to contact Tycon Systems and keep their systems up to date.
https://www.tyconsystems.com/contact
Relevant CWE: CWE-312 Cleartext Storage of Sensitive Information
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n4.3 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | \n
| 4.0 | \n5.3 | \nMEDIUM | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-21 | \n1 | \nInitial Publication | \n
Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition.
\nThe following versions of NASA Core Flight System (cFS) Health & Safety (HS) Application are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.5 | \nNASA | \nNASA Core Flight System (cFS) Health & Safety (HS) Application | \nNULL Pointer Dereference | \n
A vulnerability exists in the Health & Safety (HS) application of NASA's Core Flight System (cFS). The flaw allows the application to crash via segmentation fault when processing a routine Housekeeping Telemetry request, leading to denial of service.
\n\nMitigation
NASA recommends users update to v7.0.1 (https://github.com/nasa/HS/releases/tag/v7.0.1)
https://github.com/nasa/HS/releases/tag/v7.0.1
Relevant CWE: CWE-476 NULL Pointer Dereference
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
| 4.0 | \n8.2 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-16 | \n1 | \nInitial Publication | \n
Successful exploitation of these vulnerabilities could allow an attacker with local or physical access to cause memory corruption, unintended information disclosure, application instability, or a denial-of-service condition in the affected product.
\nThe following versions of AutomationDirect Productivity Suite are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7 | \nAutomationDirect | \nAutomationDirect Productivity Suite | \nOut-of-bounds Write, Out-of-bounds Read, Divide By Zero | \n
An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability.
\n\nMitigation
AutomationDirect recommends that users update Productivity suite to v4.7.0.47 and above https://www.automationdirect.com/support/software-downloads.
https://www.automationdirect.com/support/software-downloads
Mitigation
If the update cannot be applied right away, the following compensating controls are recommended until the upgrade can be performed.
Mitigation
Disconnect the engineering workstation from external networks (e.g., the internet or corporate LAN) to reduce exposure.
Mitigation
Use only trusted, dedicated internal networks or air-gapped systems for device communication.
Mitigation
Restrict both physical and logical access to authorized personnel only.
Mitigation
Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software.
Mitigation
Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts.
Mitigation
Enable and regularly review system logs to detect suspicious or unauthorized activity.
Mitigation
Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident.
Mitigation
Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly.
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7 | \nHIGH | \nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
| 4.0 | \n7.3 | \nHIGH | \nCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability.
\n\nMitigation
AutomationDirect recommends that users update Productivity suite to v4.7.0.47 and above https://www.automationdirect.com/support/software-downloads.
https://www.automationdirect.com/support/software-downloads
Mitigation
If the update cannot be applied right away, the following compensating controls are recommended until the upgrade can be performed.
Mitigation
Disconnect the engineering workstation from external networks (e.g., the internet or corporate LAN) to reduce exposure.
Mitigation
Use only trusted, dedicated internal networks or air-gapped systems for device communication.
Mitigation
Restrict both physical and logical access to authorized personnel only.
Mitigation
Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software.
Mitigation
Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts.
Mitigation
Enable and regularly review system logs to detect suspicious or unauthorized activity.
Mitigation
Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident.
Mitigation
Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly.
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7 | \nHIGH | \nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
| 4.0 | \n7.3 | \nHIGH | \nCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This can lead to exposing sensitive information or causing the affected product to become unstable or unavailable.
\n\nMitigation
AutomationDirect recommends that users update Productivity suite to v4.7.0.47 and above https://www.automationdirect.com/support/software-downloads.
https://www.automationdirect.com/support/software-downloads
Mitigation
If the update cannot be applied right away, the following compensating controls are recommended until the upgrade can be performed.
Mitigation
Disconnect the engineering workstation from external networks (e.g., the internet or corporate LAN) to reduce exposure.
Mitigation
Use only trusted, dedicated internal networks or air-gapped systems for device communication.
Mitigation
Restrict both physical and logical access to authorized personnel only.
Mitigation
Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software.
Mitigation
Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts.
Mitigation
Enable and regularly review system logs to detect suspicious or unauthorized activity.
Mitigation
Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident.
Mitigation
Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly.
Relevant CWE: CWE-125 Out-of-bounds Read
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.1 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H | \n
| 4.0 | \n6.9 | \nMEDIUM | \nCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N | \n
An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This could lead to limited information disclosure or disruption of the affected product.
\n\nMitigation
AutomationDirect recommends that users update Productivity suite to v4.7.0.47 and above https://www.automationdirect.com/support/software-downloads.
https://www.automationdirect.com/support/software-downloads
Mitigation
If the update cannot be applied right away, the following compensating controls are recommended until the upgrade can be performed.
Mitigation
Disconnect the engineering workstation from external networks (e.g., the internet or corporate LAN) to reduce exposure.
Mitigation
Use only trusted, dedicated internal networks or air-gapped systems for device communication.
Mitigation
Restrict both physical and logical access to authorized personnel only.
Mitigation
Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software.
Mitigation
Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts.
Mitigation
Enable and regularly review system logs to detect suspicious or unauthorized activity.
Mitigation
Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident.
Mitigation
Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly.
Relevant CWE: CWE-125 Out-of-bounds Read
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.1 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H | \n
| 4.0 | \n6.9 | \nMEDIUM | \nCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N | \n
An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB device. This can lead to a system crash or disclosure of kernel memory.
\n\nMitigation
AutomationDirect recommends that users update Productivity suite to v4.7.0.47 and above https://www.automationdirect.com/support/software-downloads.
https://www.automationdirect.com/support/software-downloads
Mitigation
If the update cannot be applied right away, the following compensating controls are recommended until the upgrade can be performed.
Mitigation
Disconnect the engineering workstation from external networks (e.g., the internet or corporate LAN) to reduce exposure.
Mitigation
Use only trusted, dedicated internal networks or air-gapped systems for device communication.
Mitigation
Restrict both physical and logical access to authorized personnel only.
Mitigation
Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software.
Mitigation
Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts.
Mitigation
Enable and regularly review system logs to detect suspicious or unauthorized activity.
Mitigation
Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident.
Mitigation
Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly.
Relevant CWE: CWE-125 Out-of-bounds Read
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.9 | \nMEDIUM | \nCVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H | \n
| 4.0 | \n5.2 | \nMEDIUM | \nCVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N | \n
A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a division by zero leading to a system crash.
\n\nMitigation
AutomationDirect recommends that users update Productivity suite to v4.7.0.47 and above https://www.automationdirect.com/support/software-downloads.
https://www.automationdirect.com/support/software-downloads
Mitigation
If the update cannot be applied right away, the following compensating controls are recommended until the upgrade can be performed.
Mitigation
Disconnect the engineering workstation from external networks (e.g., the internet or corporate LAN) to reduce exposure.
Mitigation
Use only trusted, dedicated internal networks or air-gapped systems for device communication.
Mitigation
Restrict both physical and logical access to authorized personnel only.
Mitigation
Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software.
Mitigation
Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts.
Mitigation
Enable and regularly review system logs to detect suspicious or unauthorized activity.
Mitigation
Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident.
Mitigation
Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly.
Relevant CWE: CWE-369 Divide By Zero
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.5 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
| 4.0 | \n6.8 | \nMEDIUM | \nCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-16 | \n1 | \nInitial Publication | \n
Successful exploitation these vulnerabilities could allow an attacker to execute arbitrary code in the context of the current process.
\nThe following versions of Rockwell Automation Arena are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.8 | \nRockwell Automation | \nRockwell Automation Arena | \nOut-of-bounds Write | \n
A security issue exists within Arena Simulation due to a memory corruption vulnerability in the model.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.
\n\nMitigation
Rockwell Automation recommends users to update to V17.00.01
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
| 4.0 | \n7 | \nHIGH | \nCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
A security issue exists within Arena Simulation due to a memory corruption vulnerability in the expmt.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.
\n\nMitigation
Rockwell Automation recommends users to update to V17.00.01
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
| 4.0 | \n7 | \nHIGH | \nCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
A security issue exists within Arena Simulation due to a memory corruption vulnerability in the linker.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.
\n\nMitigation
Rockwell Automation recommends users to update to V17.00.01
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
| 4.0 | \n7 | \nHIGH | \nCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
A security issue exists within Arena Simulation due to a memory corruption vulnerability in the siman.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.
\n\nMitigation
Rockwell Automation recommends users to update to V17.00.01
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
| 4.0 | \n7 | \nHIGH | \nCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-16 | \n1 | \nInitial Publication | \n
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
", "summary_is_html": true, "first_seen": "Thu, 16 Jul 26 12:00:00 +0000", "last_updated": "Thu, 16 Jul 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-06", "title": "Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-06", "summary": "\nSuccessful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition.
\nThe following versions of Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 8.6 | \nRockwell Automation | \nRockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix | \nBuffer Copy without Checking Size of Input ('Classic Buffer Overflow') | \n
A denial-of-service issue exists in 5370/5570 controllers. This vulnerability could potentially allow a remote user to load an invalid project, causing the device to enter a major non-recoverable fault (MNRF).
\n\nVendor fix
Rockwell Automation recommend updating to the following: CompactLogix 5370: Update to V35.016, V36.011 and later
Vendor fix
Compact GuardLogix 5370: Update to V35.016, V36.011 and later
Vendor fix
ControlLogix 5570: Update to V35.016, V36.011 and later
Vendor fix
GuardLogix 5570: Update to V35.016, V36.011 and later
Vendor fix
CompactLogix 5380: Update to V34.014, V35.013, V36.011 and later
Vendor fix
Compact GuardLogix 5380: Update to V34.014, V35.013, V36.011 and later
Vendor fix
CompactLogix 5480: Update to V34.014, V35.013, V36.011 and later
Vendor fix
ControlLogix 5580: Update to V34.014, V35.013, V36.011 and later
Vendor fix
GuardLogix 5580: Update to V34.014, V35.013, V36.011 and later
Vendor fix
CompactLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
Compact GuardLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
CompactLogix 5480 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
ControlLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
GuardLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.6 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H | \n
| 4.0 | \n9.2 | \nCRITICAL | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H | \n
A denial-of-service issue exists in 5380/5480/5580 controllers. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major nonrecoverable fault (MNRF).
\n\nVendor fix
Rockwell Automation recommend updating to the following: CompactLogix 5370: Update to V35.016, V36.011 and later
Vendor fix
Compact GuardLogix 5370: Update to V35.016, V36.011 and later
Vendor fix
ControlLogix 5570: Update to V35.016, V36.011 and later
Vendor fix
GuardLogix 5570: Update to V35.016, V36.011 and later
Vendor fix
CompactLogix 5380: Update to V34.014, V35.013, V36.011 and later
Vendor fix
Compact GuardLogix 5380: Update to V34.014, V35.013, V36.011 and later
Vendor fix
CompactLogix 5480: Update to V34.014, V35.013, V36.011 and later
Vendor fix
ControlLogix 5580: Update to V34.014, V35.013, V36.011 and later
Vendor fix
GuardLogix 5580: Update to V34.014, V35.013, V36.011 and later
Vendor fix
CompactLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
Compact GuardLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
CompactLogix 5480 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
ControlLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
GuardLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.6 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H | \n
| 4.0 | \n9.2 | \nCRITICAL | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H | \n
A denial-of-service issue exists in 5380/5480/5580 controllers boot firmware lower than version 1.072. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault (MNRF).
\n\nVendor fix
Rockwell Automation recommend updating to the following: CompactLogix 5370: Update to V35.016, V36.011 and later
Vendor fix
Compact GuardLogix 5370: Update to V35.016, V36.011 and later
Vendor fix
ControlLogix 5570: Update to V35.016, V36.011 and later
Vendor fix
GuardLogix 5570: Update to V35.016, V36.011 and later
Vendor fix
CompactLogix 5380: Update to V34.014, V35.013, V36.011 and later
Vendor fix
Compact GuardLogix 5380: Update to V34.014, V35.013, V36.011 and later
Vendor fix
CompactLogix 5480: Update to V34.014, V35.013, V36.011 and later
Vendor fix
ControlLogix 5580: Update to V34.014, V35.013, V36.011 and later
Vendor fix
GuardLogix 5580: Update to V34.014, V35.013, V36.011 and later
Vendor fix
CompactLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
Compact GuardLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
CompactLogix 5480 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
ControlLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
GuardLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.6 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H | \n
| 4.0 | \n9.2 | \nCRITICAL | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-16 | \n1 | \nInitial Publication | \n
Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition.
\nThe following versions of Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.5 | \nRockwell Automation | \nRockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT | \nImproper Validation of Integrity Check Value | \n
A denial-of-service security issue exists across all the 1756-EN2, EN3, and ENBT communication module due to improper validation of CIP Implicit Connection packets. An attacker on the network can exploit this by sending crafted packets to continuously disrupt device connections, though device connections will recover immediately after.
\n\nVendor fix
Rockwell Automation recommends users take the following actions: 1756-EN3: Update to V12.002
Vendor fix
1756-EN2: Update to V12.002
Vendor fix
1756-ENBT: Product is discontinued, fix is unavailable
Relevant CWE: CWE-354 Improper Validation of Integrity Check Value
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-16 | \n1 | \nInitial Publication | \n
Successful exploitation of this vulnerability could allow an authenticated attacker to inject malicious scripts on the server.
\nThe following versions of Rockwell Automation FactoryTalk DataMosaix are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 6.1 | \nRockwell Automation | \nRockwell Automation FactoryTalk DataMosaix | \nImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | \n
A Stored Cross-Site Scripting security issue exists within FactoryTalk DataMosaix Private Cloud. The vulnerability stems from improper neutralization of user-supplied input within the Workflows configuration. An authenticated attacker with high privileges can inject malicious scripts that are permanently stored on the server. This vulnerability can result in the execution of malicious JavaScript when other users access the affected page, potentially allowing for account takeover, credential theft, or redirection to a malicious website.
\n\nVendor fix
Rockwell Automation recommends users to upgrade to the following: DataMosaix Private Cloud versions 8.03 or later.
Mitigation
Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight).
https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight
Mitigation
For more information, see Rockwell Automation Security Advisory SD1787 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1787.html).
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1787.html
Relevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.1 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N | \n
| 4.0 | \n8.4 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-16 | \n1 | \nInitial Republication of Rockwell Automation Security Advisory SD1787 | \n
Successful exploitation of this vulnerability allows an authenticated attacker to escalate privileges and access spaces outside their assigned partition, within the same Salto ProAccess Space installation or system. Exploitation requires valid authenticated operator credentials and the partition feature to be enabled; installations without partitioning are not affected.
\nThe following versions of SALTO ProAccess Space are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 6.5 | \nSALTO | \nSALTO ProAccess Space | \nAuthorization Bypass Through User-Controlled Key | \n
SALTO ProAccess Space software using the tenancy feature / logical partition is vulnerable to a privilege escalation attack that could allow an authorized attacker to access any space managed by the affected product.
\n\nMitigation
Users of SALTO ProAccess using the tenancy feature should upgrade to version 6.13.
Vendor fix
To further enhance security after applying the update: 1. Operate ProAccess Space on a protected internal network and avoid exposing it directly to the Internet. 2. Restrict operator-level accounts to the minimum required and apply least-privilege principles. 3. If feasible, disable the partitioning feature and operate under a single partition. 4. When strong tenant separation is required, consider running separate Space instances (isolated environments) rather than relying solely on logical partitioning.
Relevant CWE: CWE-639 Authorization Bypass Through User-Controlled Key
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N | \n
| 4.0 | \n7.1 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-16 | \n1 | \nInitial Publication | \n
Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition on the affected product.
\nThe following versions of Rockwell Automation Flex 5000 Adapter are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.5 | \nRockwell Automation | \nRockwell Automation Flex 5000 Adapter | \nDouble Free | \n
A denial-of-service security issue exists in the affected products. The security issue stems from improper handling of exceptional conditions when processing crafted CIP packets sent to the adapter. A power cycle is required to recover the module and associated I/O.
\n\nVendor fix
Rockwell Automation recommends users to upgrade to the following: Flex 5000 Adapter version 6.012.
Mitigation
Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight).
https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight
Mitigation
For more information, see Rockwell Automation Security Advisory SD1789 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1789.html).
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1789.html
Relevant CWE: CWE-415 Double Free
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-16 | \n1 | \nInitial Republication of Rockwell Automation Security Advisory SD1789 | \n
Multiple SICAM 8 products are affected by multiple vulnerabilities that could lead to denial of service, namely: - SICAM A8000 Device firmware - CPCI85 for CP-8031/CP-8050 - SICORE for CP-8010/CP-8012 - SICAM EGS Device firmware - CPCI85 - SICAM S8000 - SICORE Siemens has released new versions for the affected products and recommends to update to the latest versions.
\nThe following versions of Siemens SICAM 8 are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.2 | \nSiemens | \nSiemens SICAM 8 | \nActive Debug Code, Initialization of a Resource with an Insecure Default, Unverified Password Change | \n
The affected application includes a debugging interface that is accessible through HTTP endpoints. This could allow an authenticated attacker to disrupt the system by crashing the web process causing denial of service conditions.
\n\nVendor fix
Update to V26.20 or later version The firmware CPCI85 V26.20 is present within \u201cCP-8031/CP-8050 Package\u201d V26.20 https://support.industry.siemens.com/cs/ww/en/view/109804985/ and also within \u201cSICAM EGS Package\u201d V26.20 https://support.industry.siemens.com/cs/document/109972536/
Vendor fix
Update to V26.20.0 or later version The firmware SICORE V26.20.0 is present within \u201cCP-8010/CP-8012 Package\u201d V26.20 https://support.industry.siemens.com/cs/ww/en/view/109972894/ and also within \u201cSICAM S8000 Package\u201d V26.20 https://support.industry.siemens.com/cs/document/109818240
Relevant CWE: CWE-489 Active Debug Code
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
The affected application contains a vulnerability in its firmware update mechanism's signature validation process. This could allow an attacker to install malicious firmware, leading to persistent code execution and system compromise.
\n\nVendor fix
Update to V26.20 or later version The firmware CPCI85 V26.20 is present within \u201cCP-8031/CP-8050 Package\u201d V26.20 https://support.industry.siemens.com/cs/ww/en/view/109804985/ and also within \u201cSICAM EGS Package\u201d V26.20 https://support.industry.siemens.com/cs/document/109972536/
Vendor fix
Update to V26.20.0 or later version The firmware SICORE V26.20.0 is present within \u201cCP-8010/CP-8012 Package\u201d V26.20 https://support.industry.siemens.com/cs/ww/en/view/109972894/ and also within \u201cSICAM S8000 Package\u201d V26.20 https://support.industry.siemens.com/cs/document/109818240
Relevant CWE: CWE-489 Active Debug Code
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.7 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | \n
The affected application ships with a default configuration that disables all OPC UA security mechanisms. This could allow an attacker to gain unauthorized access and control over critical system functions.
\n\nVendor fix
Update to V26.20 or later version The firmware CPCI85 V26.20 is present within \u201cCP-8031/CP-8050 Package\u201d V26.20 https://support.industry.siemens.com/cs/ww/en/view/109804985/ and also within \u201cSICAM EGS Package\u201d V26.20 https://support.industry.siemens.com/cs/document/109972536/
Vendor fix
Update to V26.20.0 or later version The firmware SICORE V26.20.0 is present within \u201cCP-8010/CP-8012 Package\u201d V26.20 https://support.industry.siemens.com/cs/ww/en/view/109972894/ and also within \u201cSICAM S8000 Package\u201d V26.20 https://support.industry.siemens.com/cs/document/109818240
Relevant CWE: CWE-1188 Initialization of a Resource with an Insecure Default
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n4.8 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N | \n
The affected application contains insufficient validation of authentication credentials when processing administrative account modifications through the web API. This could allow an authenticated attacker to bypass security controls and gain unauthorized elevated privileges.
\n\nVendor fix
Update to V26.20 or later version The firmware CPCI85 V26.20 is present within \u201cCP-8031/CP-8050 Package\u201d V26.20 https://support.industry.siemens.com/cs/ww/en/view/109804985/ and also within \u201cSICAM EGS Package\u201d V26.20 https://support.industry.siemens.com/cs/document/109972536/
Vendor fix
Update to V26.20.0 or later version The firmware SICORE V26.20.0 is present within \u201cCP-8010/CP-8012 Package\u201d V26.20 https://support.industry.siemens.com/cs/ww/en/view/109972894/ and also within \u201cSICAM S8000 Package\u201d V26.20 https://support.industry.siemens.com/cs/document/109818240
Relevant CWE: CWE-620 Unverified Password Change
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.2 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | \n
Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid's reliability can thus be minimized by virtue of the grid design. Siemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. As a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment. Recommended security guidelines can be found at: https://www.siemens.com/gridsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact Siemens: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability. Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens SSA-229470 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-07-09 | \n1 | \nPublication Date | \n
| 2026-07-16 | \n2 | \nInitial CISA Republication of Siemens SSA-229470 advisory | \n