Most compromises do not rely on advanced techniques or cutting-edge tools. Cyber threat actors scan the internet looking for exposed, well-known software vulnerabilities to exploit. Basic security failures enable most compromises and organizations can reduce their risk by addressing these underlying weaknesses and prioritizing vulnerabilities for action based on the risk they pose.
\nThe CISA Vulnerability Review provides organizations with critical insights into the root causes of insecure software and practical steps they can take to address these flaws to prevent exploitation. Analyzing CISA and open source data from fiscal years 2024 and 2025, the review establishes a baseline of today\u2019s vulnerability landscape before AI-enabled vulnerability discovery becomes more widespread. The review demonstrates the importance of Secure by Design principles in shifting cybersecurity efforts from reacting to threat actors to proactively fixing preventable software flaws.
\nThe review also identifies common software weaknesses that contribute to exploitable vulnerabilities and details practices software producers can use to prevent these weaknesses from recurring. By examining the patterns across vulnerability data, the review helps organizations focus on systemic improvements that can reduce entire classes of vulnerabilities rather than addressing individual vulnerabilities only after they are discovered.
\nAdditionally, the review shows organizations how to prioritize vulnerabilities for action using the framework outlined in Binding Operational Directive 26-04: Prioritizing Security Based on Risk. This framework evaluates vulnerabilities using four key criteria: exposure status, Known Exploited Vulnerability (KEV) Catalog status, potential for automated exploitation, and technical impact.
", "summary_is_html": true, "first_seen": "Wed, 26 Aug 26 12:00:00 +0000", "last_updated": "Wed, 26 Aug 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog", "title": "CISA Adds Six Known Exploited Vulnerabilities to Catalog", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog", "summary": "CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
", "summary_is_html": true, "first_seen": "Wed, 26 Aug 26 12:00:00 +0000", "last_updated": "Wed, 26 Aug 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-04", "title": "PayRange API", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-04", "summary": "\nSuccessful exploitation of this vulnerability could allow a remote, authenticated or unauthenticated attacker to disclose sensitive information, arbitrarily modify the device to cause a denial of service, or alter a devices displayed image.
\nThe following versions of PayRange API are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 8.8 | \nPayRange | \nPayRange API | \nMissing Authorization | \n
The affected product is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly accessible, with or without an account.
\n\nMitigation
PayRange has not responded to requests to work with CISA to mitigate this vulnerability. Users of PayRange devices are invited to contact PayRange customer support at support@payrange.com for additional information.
mailto:support@payrange.com
Relevant CWE: CWE-862 Missing Authorization
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-08-25 | \n1 | \nInitial Publication | \n
Successful exploitation of this vulnerability could allow an attacker to access sensitive information and override user permissions.
\nThe following versions of Rently Smart Home are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 8.1 | \nRently | \nRently Smart Home | \nInsufficiently Protected Credentials | \n
Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerability. This could allow an attacker to retrieve pins including the Master Pin, overriding standard user permissions.
\n\nMitigation
Rently has patched this vulnerability in late June. No user action is required.
Mitigation
For more information, contact Rently (support@rently.com).
mailto:support@rently.com
Relevant CWE: CWE-522 Insufficiently Protected Credentials
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.1 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-08-25 | \n1 | \nInitial Publication | \n
| Title | \nA Tale of Two SOCs: Insights From Two Red Team Assessments | \n
|---|---|
| Original Publication | \nAugust 25, 2026 | \n
| Executive Summary | \n\n The Cybersecurity and Infrastructure Security Agency (CISA) conducted simultaneous red team assessments at two organizations and observed different defensive outcomes. In both environments, the red team achieved full domain compromise and accessed sensitive business systems (SBSs) and cloud resources. Organization A failed to detect or contain the activity, but Organization B rapidly identified initial compromise attempts, isolated affected systems, and forced the red team into an assume breach model. \nThis advisory details the red team\u2019s activity and organizations\u2019 defensive actions, offering lessons learned and mitigations to help critical infrastructure organizations strengthen detection, response, and protections in IT, cloud, and operational technology (OT) environments. \n | \n
| Lessons Learned | \n\n
| \n
| Key Actions | \n\n
| \n
| Intended Audience | \n\n Organizations: Federal Civilian Executive Branch agencies; state, local, tribal, and territorial governments; critical infrastructure. \nRoles: System administrators, incident responders, defensive cybersecurity analysts, vulnerability analysts, network operators, security systems managers, and all network defenders. \n | \n
The Cybersecurity and Infrastructure Security Agency\u2019s (CISA\u2019s) red team simulates real\u2011world malicious cyber operations to assess an organization\u2019s ability to detect, investigate, and respond to malicious cyber activity. Emulating cyber threat actor tradecraft, the red team attempts to gain and maintain persistent access to an organization\u2019s network and sensitive business systems (SBSs) while avoiding detection.
\nCISA conducted two simultaneous red team assessments using similar tradecraft but observed different defensive responses. In one organization (Organization A), the team gained initial access to multiple workstations, gained elevated privileges over the domain, and moved laterally to SBSs and cloud resources undetected. In the second organization (Organization B), network defenders quickly detected the initial compromise and quarantined the affected systems.
\nBecause Organization B detected the initial compromise, the red team moved to an assume breach model, where Organization B trusted agents (TAs) provided access to a host that replicated the level of access the red team would have had if defenders had not detected their activity. From there, the red team escalated privileges and moved laterally to SBSs, cloud resources, and a bastion host in the OT demilitarized zone (DMZ), where defenders again detected activity and isolated the system.
\nIn coordination with the assessed organizations, CISA is releasing this Cybersecurity Advisory to describe the red team\u2019s activity and the organization\u2019s defensive responses and to share lessons learned that critical infrastructure organizations can use to strengthen their IT, cloud, and OT cybersecurity posture.
\nCISA encourages critical infrastructure organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of malicious cyber incidents.
\nDownload the PDF version of this report:
\n\n\n\n\n\nNote: This advisory uses the MITRE ATT&CK\u00ae Matrix for Enterprise framework, version 19. See the MITRE ATT&CK Tactics and Techniques section of this advisory for a table of the red team\u2019s activity mapped to MITRE ATT&CK tactics and techniques.
\nCISA is authorized\u2014upon request\u2014to provide analyses, expertise, and other technical assistance to critical infrastructure owners and operators and to provide operational and timely technical assistance to federal and non-federal entities, with respect to cybersecurity risks (see generally 6 U.S.C. \u00a7\u00a7 652[c][5], 659[c][6]). CISA conducted two concurrent red team assessments: one at a Government Services and Facilities Sector organization (Organization A), and one at a Water and Wastewater Systems Sector organization (Organization B).
\nDuring CISA\u2019s red team assessments, the red team simulates malicious cyber operations to assess an organization\u2019s threat detection and response capabilities. The red team attempts to gain and maintain persistent access to an organization\u2019s enterprise network, avoid detection, evade defenses, and access SBSs (applications, data stores, or infrastructure components where compromise would materially impact the organization's operations, finances, or customer data) selected by the organization. For the assessments described in this advisory, the team also attempted to gain access to cloud resources and to demonstrate their ability to access Organization B\u2019s OT systems without actually doing so.
\nDuring reconnaissance, CISA\u2019s red team identified a web application with default credentials [T1589.001] for multiple built-in user accounts that allowed the team to send emails from an internal email address. The team used the internal email address to send phishing emails [T1566] and gained initial access to four workstations.
\nFrom the workstations, the red team leveraged a modified BloodHound1 collector, customized to avoid static endpoint detection and response (EDR) signatures, to query and scrape Active Directory (AD) information. This information included AD users [T1087.002], computers [T1018], groups [T1069.002], access control lists, organizational units, and group policy objects (GPOs) [T1615]. The team found that one compromised workstation had the default Machine Account Quota (MAQ) of 10, allowing unprivileged users to add up to 10 computer accounts to the domain.
\nThe red team also queried the organization\u2019s Active Directory Certificate Service (ADCS) certificate templates. Misconfigured ADCS templates are common and can allow low-privileged accounts to request a certificate on behalf of other users and computers, including highly privileged accounts. The team identified multiple templates with an ESC1 misconfiguration, which allows any user to request certificates for all users and computer accounts (see scenario ESC1 in SpecterOp\u2019s Certified Pre-Owned: Abusing Active Directory Certificate Services). The red team exploited the misconfigured MAQ to create a machine account [T1136.002] and then exploited a misconfigured ADCS template to request a certificate for the newly created machine account [T1649]. They could then obtain certificates for any user account, providing means for lateral movement.
\nAfter the red team gained elevated privileges over the domain, they began post-exploitation activities and attempted to access SBSs. To access the SBSs, the team needed to identify their network location and security controls.
\nThe team\u2019s plan to achieve SBS access included the following steps:
\nFor each SBS, the red team used similar discovery and initial access techniques but unique credential retrieval methods. For SBS 1, a database, the team located cleartext credentials on an administrative user\u2019s workstation providing access to the system [T1552]. For SBS 2, also a database, the red team searched the targeted user\u2019s workstations for connections.json and product-preferences.xml files for a Structured Query Language (SQL) developer tool. The team decrypted these files to obtain the cleartext password to the database [T1552.001]. For SBS 3, an automated processing system, the red team acquired long-lived static Amazon Web Service (AWS) identity and access management (IAM) user credentials saved in configuration files in targeted users\u2019 home directories. These credentials do not expire because the organization had not configured credential expiration or rotation.
For SBS 2 and 3, the red team expanded access beyond users\u2019 physical workstations to include their virtual desktops, which limited their access to the active, interactive sessions held by users. While virtual workstations add security controls, such as segmenting networks of sensitive systems to only allow virtual hosts, they are generally synchronized with a root drive of the distributed file system (DFS). The red team compromised the root DFS drive, granting them access to local files of all users\u2019 virtual desktops, regardless of the existence of an active session. This allowed the team to quickly search for cloud configuration files containing credentials and database connection files for thousands of users.
\nThe red team obtained administrative access to all targeted SBSs without defensive intervention by proxying tools [T1090.001] through compromised workstations and using the collected credentials.
\nAfter compromising the target SBSs, the red team attempted to compromise Organization A\u2019s Microsoft cloud environment by compromising Organization A\u2019s Microsoft Entra ID (formerly Azure AD) through applications. The team targeted Entra ID applications with Application permissions, which allow applications to access data without user consent (compared to Delegated permissions, which allow applications to access data with user consent). By compromising an application that had elevated Application permissions, the red team would gain the same permissions as the application because these applications operate outside the scope of traditional conditional access policies (CAPs) that provide controls for user access and activity.
\nNote: Microsoft\u2019s Conditional Access for workload identities extends traditional CAPs to service principals (SPs) used by applications and governs Application permissions by allowing organizations to broadly apply access policies to applications. Implementing Conditional Access for workload identities would have protected against red team exploiting use of Application permissions; however, the red team never observed an organization using Conditional Access for workload identities.
\nThe team compromised applications and used their permissions by:
\nMail.Read \u2013 Read Outlook emails.Mail.ReadWrite \u2013 Read and write Outlook emails.Chat.Read.All \u2013 Access Teams messages.Files.Read.All \u2013 Access OneDrive.Application.ReadWrite.All \u2013 Add Client Secrets to any application or SP.AppRoleAssignment.ReadWrite.All \u2013 Lets an SP grant itself powerful Graph application permissions such as Chat.Read.All or RoleManagement.ReadWrite.Directory.Mail.ReadWrite permissions.This allowed the red team to review security operations center (SOC) staff emails to see if SOC staff were aware of the compromise.
\nThe organization did not respond effectively to red team activity. The red team observed this during their engagement by accessing SOC personnel emails and moving laterally to SOC workstations where they captured screenshots [T1113], used keyloggers [T1056.001], and retrieved Microsoft Teams messages [T1213.005].
\nThe red team observed that the SOC received medium- and low-severity EDR alerts related to the red team activity but did not respond to them. Thousands of false positive alerts corresponding to normal business operations, many with a higher severity, obscured the alerts triggered by red team activity.
\nOrganizational silos further hindered detection and response. The organization had multiple SOCs and multiple EDR solutions. Staff did not communicate with staff from other SOCs or have visibility on their detection tools. SOC staff and system owners also did not communicate with each other.
\nThis led to SOC staff not actioning alerts from red team activity. For example, red team members noted chat exchanges regarding an SCCM in which defenders tried and failed to identify the system owner, its function, and its typical use. The SOC team eventually flagged the alert as a false positive.
\nThe red team believes this was because the SOC staff lacked standard operating procedures for escalating alerts and had limited personnel authority.
\nThe CISA red team gained initial access to Organization B\u2019s environment through a spearphishing campaign. The team gathered email addresses from public websites [T1589.002] and sent phishing emails that eventually led to three users clicking [T1204] on a malicious link, giving the red team access to three workstations.
\nEach payload execution generated a medium-severity alert: \u201cAn executable file loaded an unexpected DLL file.\u201d SOC staff triaged these alerts and manually isolated all three workstations within 10, 2, and 20 minutes. This effectively terminated the team\u2019s command and control (C2) communications with the workstations. Before staff isolated one workstation, the red team enumerated Organization B\u2019s domain\u2019s AD structure by executing various Lightweight Directory Access Protocol (LDAP) queries through the callback. The data gathered included all users, groups, computers, domains, GPO, and subsequent relationships for the entire domain.
\nBecause the defenders removed their initial foothold, the red team switched to an assume breach model. Organization B\u2019s TAs (organization IT staff who knew of the assessment and were in contact with the red team) executed a red-team-provided payload on a designated internal host. This host was associated with a standard user account with no administrative privileges, replicating the same level of access the red team would have maintained if Organization B\u2019s defenders had not detected them.
\nWith persistent access to the internal network, the red team searched for ways to escalate their privileges over the domain to facilitate lateral movement and access SBSs. The red team used the assume breach account to query the MAQ attribute of Organization B\u2019s domain and discovered that all domain users were able to add accounts to the domain.
\nThe red team created a new machine account with a hostname designed to resemble a legitimate host. The creation of the machine account provided the red team with a domain account and a password that they controlled. This allowed them to execute standalone tools from a red-team-controlled Linux workstation. The tool\u2019s traffic was proxied through the assume breach host, circumventing restrictions imposed by host-based EDR.
\nThe red team did not identify any escalation paths from the AD data; however, enumeration of SCCM distribution points led to the discovery of an XML file with cleartext credentials for a domain service account. AD data showed that the newly acquired service account had outbound object control over almost 1,000 accounts within the domain due to its group membership. Most notably, the service account had AllExtendedRights permission over a domain controller, which enabled the team to conduct a resource-based constrained delegation attack, granting them DCSync privileges [T1003.006] and the ability to obtain AD account credentials. The team used these credentials throughout the remainder of their assessment to access servers and workstations. One of the first accounts the red team DCSynced was the krbtgt account, which a malicious cyber actor could use to forge Golden Tickets that allow for impersonation of any user in Organization B\u2019s domain.
The TAs provided the names of two SBSs, one of which the red team successfully compromised. To do this, the team reviewed previously collected BloodHound data and identified a user account with access to an SBS web server that allowed Kerberos authentication. Because the red team had already compromised the on-premises (on-prem) AD environment, they could impersonate this user to access the server.
\nThe team:
\nAfter requesting the Kerberos service ticket, the red team imported it into a Windows virtual machine (VM) on their infrastructure. The red team configured their VM to proxy any traffic to Organization B\u2019s network through a SOCKS proxy that tunneled traffic through a compromised host.
\nThe red team wanted to gain visibility of the OT network and identify OT network subnets. To do this, they first identified an IT workstation with Remote Desktop Protocol (RDP) files, including a file named ics-[redacted]-org, signifying that the user likely had remote access to the OT network. The red team identified that the workstation had remote access to a bastion host. A bastion host\u2014sometimes referred to as a jump box or jump server\u2014is a specialized, highly secured system (often a server or dedicated workstation) that serves as the sole access point between a network segment (such as an internal IT network) and a protected internal network (like an OT environment).
The red team gained access to this bastion host using File Transfer Protocol (FTP) credentials to log in over Secure Shell (SSH) [T1021.004]. At this point, they had visibility over the OT network.
\nThey attempted to gain a C2 session on the server by dropping several payload files on the host and executing them. However, the callback never reached red team infrastructure because the host blocked outbound internet connections. The payload execution triggered an alert that led SOC staff to quarantine the host.
\nThe red team attempted to access Organization B\u2019s cloud-based Entra ID infrastructure to find a way to move from on-prem AD to the cloud. Organization B had a hybrid environment, and user credentials automatically synchronized between on-prem AD and cloud Entra ID. Given this, the red team looked for the on-prem server responsible for synchronization.
\nEntra ID Connect (formerly Azure AD Connect) sets up an on-prem account with the prefix MSOL_ to synchronize credentials with Entra ID. The red team used the open source tool ADConnectDump4 to obtain cleartext credentials for the on-prem Microsoft Online (MSOL) account and the Entra ID account Sync_[redacted] [T1003]. With cleartext credentials for Sync_[redacted], the red team logged into the Azure portal. Sync_[redacted] was not intended for interactive logins and, in this case, did not have multifactor authentication (MFA) enabled. However, the red team used this account to obtain access tokens for use with AzureHound and ROADrecon to gather Entra ID data for Organization B\u2019s tenant.
Note: The red team obtained cleartext MSOL credentials and logged into the Azure portal because MSOL accounts used to have a large number of permissions; Microsoft has since removed these permissions. See Microsoft\u2019s Action required: MSOnline and AzureAD PowerShell retirement - 2025 info and resources and Important update: Deprecation of Azure AD PowerShell and MSOnline PowerShell modules for more information.
\nThe interactive login from Sync_[redacted] triggered an automated alert from Microsoft, which sent the information to Organization B\u2019s SOC staff, who then blocked the suspicious activity.
The red team identified a computer account containing AZURESSO in its name, located in the on-prem AD environment. This account is part of the Seamless SSO implementation and allows users to use Kerberos tickets as the first step in authenticating to Entra ID. To abuse Seamless SSO, the red team acquired encrypted credentials of a target user via DCSync and then used the Rubeus \u201casktgs\u201d module to request service tickets used for SSO. The red team imported the service tickets to their workstation and proxied their traffic through Organization B\u2019s network using a SOCKS proxy. This allowed them to browse to https://portal[.]azure[.]com, while using legitimate Kerberos tickets, and the traffic appeared to originate from a trusted IP address.
This approach allowed the red team to gain access to Entra ID as any user synced to AD without the user\u2019s cleartext password. However, they could only use Kerberos tickets for the first phase of the sign-in process. If a user was set up to use MFA, then Entra ID would prompt the red team for a second factor during the sign-in process. Therefore, the red team was only able to log into any Entra ID account that did not have MFA enabled, which seemed limited to service accounts. They reviewed the previously obtained Entra ID data and looked for applications that had excessive permissions and were accessible to AD-synced service accounts.
\nThe red team identified an application that had permission to read, write, and send emails for all users within Organization B\u2019s tenant. The application was owned by an AD-Synced account that was disabled in AD. Using a compromised host in the on-prem environment, they re-enabled this account, DCSynced its credentials, and used the AES256 hash to request Kerberos tickets. The red team used the tickets to authenticate to Entra ID and were then able to add a client secret to the application. This gave them the ability to retrieve the emails of every user within Organization B\u2019s environment from the public internet.
\nOrganization B quickly triaged and responded to alerts after the red team gained initial access, effectively terminating the team\u2019s C2 communications with the workstations and leading the red team to move to an assume breach model. These actions demonstrated a mature, proactive security posture and helped prevent wider compromise.
\nWhen the red team gained access to a bastion host in the OT DMZ, Organization B had defensive controls that blocked outbound connections to red team infrastructure, and SOC staff quickly triaged and responded to an alert by isolating the host.
\nWhen the red team logged into the organization\u2019s Azure portal via a compromised account, it triggered an automated alert from Microsoft, which led the staff to block the suspicious account. In addition, Organization B had custom detections Entra ID Risky User Alerts for \u201cUnfamiliar sign-in properties\u201d and \u201cSuspicious API traffic\u201d that alerted to the AzureHound user agent and to accounts exceeding predefined request thresholds to the Microsoft Graph API.
\nSee Table 1 for Organization B\u2019s defensive measures and associated response.
\n| Red Team Activity | \nDefensive Measure | \nSOC Response | \nOutcome | \n
|---|---|---|---|
| C2 payload executed on a workstation. | \nPayload execution generated a medium-severity alert. | \nStaff quarantined workstation; staff analyzed and reimaged before putting workstation back online. | \nRed team lost access to a workstation. | \n
| C2 payload executed on a second workstation. | \nPayload execution generated a medium-severity alert. | \nStaff quarantined workstation; staff analyzed and reimaged before putting workstation back online. | \nRed team lost access to a workstation. | \n
| C2 payload executed on a third workstation. | \nPayload execution generated a medium-severity alert. | \nStaff quarantined workstation; staff analyzed and reimaged before putting workstation back online. | \nRed team lost access to a workstation. | \n
| C2 payload executed on bastion host in the OT DMZ. | \nPayload execution generated alerts. | \nStaff quarantined the host. | \nRed team lost access to the host. | \n
| Used compromised Entra ID account to log into Azure. | \nAutomated alert from Microsoft. | \nStaff blocked the account. | \nRed team compromised a different account and accessed Entra ID by abusing Seamless SSO. | \n
Despite these strengths, Organization B had areas for improvement. The red team was eventually able to access Entra ID through a computer account that was part of the organization\u2019s Seamless SSO implementation. The account did not have MFA and had overly permissive application permissions, indicating the need for more mature cloud security processes.
\nAdditionally, Organization B had excessive permissions and misconfigurations in AD and service accounts, which the red team leveraged for privilege escalation. This highlights the importance of regular audits and strict enforcement of least privilege principles. Organization B could improve credential hygiene, as the red team found credentials for OT systems stored in plaintext on jump servers. Finally, while segmentation and egress controls were effective, ongoing review and tightening of IT/OT connectivity and access architectures would reduce opportunities for lateral movement.
\nThe red team identified lessons learned based on each organization\u2019s response. Organization A and Organization B contrasted significantly in their ability to quickly identify and respond to red team activity. However, similar gaps in both organizations contributed to the red team\u2019s compromise of their cloud systems.
\nOrganization A did not tune their detection tools to reduce alert noise, leading to an unmanageable level of alerts for SOC staff to review and action. The same red team activity that triggered alerts and action for Organization B led to no response for Organization A because SOC staff did not identify the activity as potentially malicious amid the overwhelming volume of alerts. Organization B had an established baseline and a fine-tuned alert system, allowing defenders to effectively filter out routine business activity and false positives. As a result, anomalies stood out, enabling the SOC staff to quickly detect and respond to red team activity.
\nWithout well-defined baselines and alert filtering, false positives and routine alerts overwhelm defenders, obscuring real threats. Organizations that tune alerts to highlight anomalies and filter out normal business activity enable defenders to focus on genuine incidents and respond rapidly.
\nIn Organization A, lack of communication and visibility created by organizational silos (among multiple SOCs and between SOC staff and system owners) hindered effective incident response, resulting in missed opportunities for identification of a major breach.
\nBureaucratic barriers arose because SOC staff managed systems without understanding their authorities as responsibilities and authorities varied across network segments. They had no escalation procedures and so defaulted to a \u201cwait and see\u201d approach.
\nIn contrast, Organization B empowered its defenders to act decisively. Staff quickly triaged alerts, investigated root causes, identified misconfigurations, and coordinated remediation with engineering.
\nDetection tools are only as effective as the people, processes, and procedures supporting them. SOC staff should not operate in silos and should have clear authority unhindered by bureaucracy to effectively contain and resolve incidents.
\nBoth organizations underestimated the risks associated with cloud environments. They granted excessive permissions to cloud applications, allowing the red team to access cloud systems. They also lacked fully mature, defined processes for detecting and remediating compromise of cloud environments, allowing the red team to maintain access to cloud resources.
\nOrganization A used long-lived static IAM user credentials that were set to never expire. If a malicious actor obtains them, they will have all the user permissions, potentially enabling persistent, unrestricted access to the cloud environment.
\nBoth organizations lacked Conditional Access for workload identities. This feature extends Conditional Access beyond user accounts, covering non-human identities, such as applications. It allows organizations to broadly apply access policies to applications that control how and when the application is used to access resources. Instead, both organizations used broad application permissions for most apps, which the team was able to exploit for access to the environment. In both organizations, the team was able to exploit excessive permissions to read emails.
\nBoth organizations lacked processes for revoking compromised access/refresh tokens. Without a well-defined, efficient process for remediating and revoking access/refresh tokens following a cloud compromise, malicious cyber actors evicted from on-prem environments may still leverage cloud access to regain entry. Organizations should establish mature procedures to detect and remediate compromises of cloud environments to prevent malicious cyber actors from reestablishing access.
\nThe red team identified the following issues that contributed to their ability to maintain persistent access to Organization A and/or B and escalate privileges or move laterally:
\nCT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag is enabled and low-privileged users can request certificates. This allows malicious actors to impersonate users. See SpecterOp\u2019s Certified Pre-Owned: Abusing Active Directory Certificate Services for information about the ESC1 misconfiguration.AllExtendedRights permission over a domain controller. AllExtendedRights enables malicious cyber actors to perform DCsync attacks and potentially impersonate any account in the domain, leading to full domain compromise.The red team identified an additional issue that was not exploited during the assessment but could be exploited by malicious cyber actors:
\nSee Table 2 to Table 11 for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK\u2019s Best Practices for MITRE ATT&CK Mapping and CISA\u2019s Decider Tool.
\n| Technique Title | \nID | \nUse | \n
|---|---|---|
| Gather Victim Identity Information: Credentials | \nT1589.001 | \nThe red team performed reconnaissance and identified a web application with default credentials. | \n
| Gather Victim Identity Information: Email Addresses | \nT1589.002 | \nThe red team performed reconnaissance and gathered employee email addresses from public websites. | \n
| Technique Title | \nID | \nUse | \n
|---|---|---|
| Obtain Capabilities: Tool | \nT1588.002 | \nThe red team used publicly available tools, including AzureHound and ROADrecon. | \n
| Technique Title | \nID | \nUse | \n
|---|---|---|
| Phishing | \nT1566 | \n\n The red team gained initial access to four Organization A workstations by sending phishing emails from an internal email address. \nThe red team gained initial access to three Organization B workstations via spearphishing emails that eventually led users to click on a malicious payload. \n | \n
| Technique Title | \nID | \nUse | \n
|---|---|---|
| User Execution | \nT1204 | \nThe red team\u2019s spearphishing emails eventually led to users clicking on a malicious payload. | \n
| Technique Title | \nID | \nUse | \n
|---|---|---|
| Create Account: Domain Account | \nT1136.002 | \nThe red team exploited misconfigured MAQs to create machine accounts on a workstation. | \n
| Technique Title | \nID | \nUse | \n
|---|---|---|
| Unsecured Credentials | \nT1552 | \n\n The red team located cleartext credentials on an administrative user\u2019s workstation. \nThe red team used the open source tool ADConnectDump to obtain cleartext credentials for cloud accounts. \n | \n
| Unsecured Credentials: Credentials In Files | \nT1552.001 | \n\n The red team searched a targeted user\u2019s workstations for The red team acquired long-lived static AWS IAM user credentials in configuration files in users\u2019 home directories. \n | \n
| OS Credential Dumping | \nT1003 | \nThe red team obtained cleartext credentials for an on-prem MSOL account and Entra account. | \n
| OS Credential Dumping: DCSync | \nT1003.006 | \nThe red team used DCSync to obtain AD account credentials. | \n
| Steal or Forge Authentication Certificates | \nT1649 | \nThe red team could obtain certificates for any Organization A user account. This provided the means for lateral movement. | \n
| Steal or Forge Kerberos Tickets | \nT1558 | \n\n The red team used a Kerberos TGT to request a Kerberos service ticket for a web server\u2019s SPN. \nThe red team used the Rubeus \u201casktgs\u201d module to request service tickets used for SSO. \n | \n
| Technique Title | \nID | \nUse | \n
|---|---|---|
| Account Discovery: Domain Account | \nT1087.002 | \nThe red team used a BloodHound collector to query and scrape AD information, including AD users. | \n
| Remote System Discovery | \nT1018 | \nThe red team used a BloodHound collector to query and scrape AD information, including computers. | \n
| Permission Groups Discovery: Domain Groups | \nT1069.002 | \nThe red team used a BloodHound collector to query and scrape AD information, including groups. | \n
| Group Policy Discovery | \nT1615 | \nThe red team used a BloodHound collector to query and scrape AD information, including GPOs. | \n
| System Owner/User Discovery | \nT1033 | \nThe red team queried SCCM servers to enumerate user-device relationships and identify the workstations assigned to users. | \n
| Cloud Service Discovery | \nT1526 | \nThe red team used publicly available tools to obtain a list of Entra applications, their permissions, and their owners. | \n
| Technique Title | \nID | \nUse | \n
|---|---|---|
| Use Alternate Authentication Material: Application Access Token | \nT1550.001 | \nThe red team used an application access token to access and review cloud emails. | \n
| Remote Services: SSH | \nT1021.004 | \nThe red team used FTP credentials to log into a bastion host over SSH. | \n
| Technique Title | \nID | \nUse | \n
|---|---|---|
| Email Collection | \nT1114 | \n\n The red team reviewed Organization A SOC staff cloud emails to see if SOC staff were aware of the compromise. \nThe red team had the ability to retrieve the emails of every user within Organization B\u2019s environment from the public internet. \n | \n
| Screen Capture | \nT1113 | \nThe red team took screenshots of SOC staff workstations. | \n
| Input Capture: Keylogging | \nT1056.001 | \nThe red team used keyloggers on SOC staff workstations. | \n
| Data from Information Repositories: Messaging Applications | \nT1213.005 | \nThe red team pulled Microsoft Teams messages from SOC staff workstations. | \n
| Technique Title | \nID | \nUse | \n
|---|---|---|
| Proxy: Internal Proxy | \nT1090.001 | \nThe red team proxied through compromised workstations. | \n
CISA recommends that organizations implement the mitigations below to strengthen their cybersecurity posture based on the Lessons Learned and identified Issues. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA\u2019s CPGs webpage for more information on the CPGs, including additional recommended baseline protections.
\nNote: While both organizations used Microsoft Entra ID and Organization B also used AWS, many of the techniques used by the red team are applicable across identity providers and cloud environments and not necessarily unique to Microsoft and AWS. CISA encourages all organizations using cloud environments to implement the recommendations below.
\nFor organizations using Entra ID:
\nMail.Read, Files.Read.All).In AWS environments:
\nCT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag from templates to prevent users from supplying and editing sensitive security settings within these templates.CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag.FullControl, WriteDacl, and Write property permissions from low-privileged groups, such as domain users, to certificate template objects, where such permissions are not needed.In addition to applying mitigations, CISA recommends exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&CK Matrix for Enterprise framework in this advisory. CISA recommends testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory.
\nTo get started:
\nCISA recommends continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.
\nOrganizations are encouraged to report suspicious or criminal activity related to information in this advisory to CISA via CISA\u2019s 24/7 Operations Center at contact@cisa.dhs.gov or 1-844-Say-CISA (1-844-729-2472). When available, please include the following information regarding the incident:
\nThe information in this report is being provided \u201cas is\u201d for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.
\nAugust 25, 2026: Initial version.
\n1 \u201cSpecterOps / Bloodhound,\u201d GitHub, last modified July 15, 2026, https://github.com/SpecterOps/BloodHound.
\n2 \u201cSpecterOps / AzureHound,\u201d GitHub, last modified June 4, 2026, https://github.com/SpecterOps/AzureHound.
\n3 \u201cROADrecon,\u201d GitHub, https://github.com/dirkjanm/ROADtools/tree/master/roadrecon.
\n4 \u201cdirkjanm/adconnectdumb,\u201d GitHub, last modified August 25, 2026, https://github.com/dirkjanm/adconnectdump.
", "summary_is_html": true, "first_seen": "Tue, 25 Aug 26 12:00:00 +0000", "last_updated": "Tue, 25 Aug 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/alerts/2026/08/25/cisa-adds-one-known-exploited-vulnerability-catalog", "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/alerts/2026/08/25/cisa-adds-one-known-exploited-vulnerability-catalog", "summary": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
", "summary_is_html": true, "first_seen": "Tue, 25 Aug 26 12:00:00 +0000", "last_updated": "Tue, 25 Aug 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-02", "title": "Zoneminder", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-02", "summary": "\nSuccessful exploitation of this vulnerability could result in full Remote Code Execution (RCE) as the web server user.
\nThe following versions of Zoneminder are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 8.8 | \nZoneminder | \nZoneminder | \nImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | \n
An authenticated OS Command Injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.
\n\nVendor fix
Zoneminder recommends upgrading to version 1.38.3 or later by downloading the installer for your system at: https://zoneminder.com/downloads.
https://zoneminder.com/downloads
Vendor fix
Users may also get the source code from Zoneminder's Github: https://github.com/ZoneMinder/zoneminder.
https://github.com/ZoneMinder/zoneminder
Vendor fix
For more details refer to Zoneminder's security advisories at: https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3.
https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3
Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-08-25 | \n1 | \nInitial Publication | \n
SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed contain a missing authentication vulnerability in the Node-RED HTTP interface that could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges. Siemens has released a new version for SIMATIC IoT2050 Advanced and strongly recommends to update to the latest version.
\nThe following versions of Siemens SIMATIC IoT2050 Advanced are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 10 | \nSiemens | \nSiemens SIMATIC IoT2050 Advanced | \nMissing Authentication for Critical Function | \n
Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server. This could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges.
\n\nMitigation
Harden the Node-RED installation (see Node-RED User Guide)
Mitigation
Uninstall Node-RED
Vendor fix
Update to V4.3.4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109741799/
Relevant CWE: CWE-306 Missing Authentication for Critical Function
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n10 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | \n
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-834709 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-08-11 | \n1 | \nPublication Date | \n
| 2026-08-25 | \n2 | \nInitial CISA Republication of Siemens ProductCERT SSA-834709 advisory | \n
Successful exploitation of these vulnerabilities could allow an attacker to alter device settings.
\nThe following versions of FURUNO FA-50 Class B AIS Transponder are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 9.1 | \nFURUNO ELECTRIC CO.,LTD. | \nFURUNO FA-50 Class B AIS Transponder | \nUse of Hard-coded Credentials, Missing Authentication for Critical Function | \n
An attacker, who knows the credentials and has access to the in-vessel network to which the device is connected to, may operate the settings screen using that credentials to alter the settings of the device.
\n\nMitigation
FURUNO ELECTRIC CO.,LTD. notes that production of this product ended in October 2020, and software updates will no longer be provided. FURUNO recommends users do not connect the product directly to the internet. To prevent unauthorized access, the vessel on which the product is installed should be properly locked and managed.
Relevant CWE: CWE-798 Use of Hard-coded Credentials
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.1 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H | \n
| 4.0 | \n8.8 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N | \n
Some configurations may be changed on the management screen without authentication.
\n\nMitigation
FURUNO ELECTRIC CO.,LTD. notes that production of this product ended in October 2020, and software updates will no longer be provided. FURUNO recommends users do not connect the product directly to the internet. To prevent unauthorized access, the vessel on which the product is installed should be properly locked and managed.
Relevant CWE: CWE-306 Missing Authentication for Critical Function
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-08-25 | \n1 | \nInitial Publication | \n
Successful exploitation of these vulnerabilities could allow an attacker to cause the loss of ABS functions, steering assist, speedometer, shifting capabilities, or disable automatic traction control.
\nThe following versions of Bendix EC80 Brake ECU are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.5 | \nBendix | \nBendix EC80 Brake ECU | \nStack-based Buffer Overflow, Out-of-bounds Write, Use of Hard-coded Credentials | \n
The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A crafted payload can then be used to remotely execute arbitrary code or inject arbitrary CAN bus traffic. This could cause the loss of the ABS function, steering assist, speedometer, and shifting.
\n\nMitigation
Bendix recommends users update their firmware to the most recent firmware version releases. Users that need more help should contact Bendix directly at info@Bendix.com.
mailto:info@Bendix.com
Vendor fix
EC80ESP+ J1708: Z228999 users should update their firmware to version Z300822.
Vendor fix
EC80ESP+ 6S/6M: Z228999 users should update their firmware to version Z300822.
Vendor fix
EC80ESP+ PLC: Z228999 users should update their firmware to version Z300822.
Vendor fix
EC80ESP+ 2nd CAN: Z228999 users should update their firmware to version Z300822.
Vendor fix
EC80ESP+ Integrated TPMS: Z228999 users should update their firmware to version Z300822.
Vendor fix
EC80ESP 6S/6M: Z266494 users should update their firmware to version Z302578.
Vendor fix
EC80ESP PLC: Z266494 users should update their firmware to version Z302578.
Vendor fix
EC80ESP 2nd CAN: Z266494 users should update their firmware to version Z302578.
Vendor fix
EC80ESP CAN Gateway: Z266494 users should update their firmware to version Z302578.
Vendor fix
EC80ESP 4S/4M: Z286098 users should update their firmware to version Z302579.
Vendor fix
EC80ESP PLC: Z286098 users should update their firmware to version Z302579.
Relevant CWE: CWE-121 Stack-based Buffer Overflow
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
| 4.0 | \n7.7 | \nHIGH | \nCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
The affected product is vulnerable to an out-of-bounds write, which could allow an attacker to deliver a payload that could establish an arbitrary write primitive, which could crash the ECU.
\n\nMitigation
Bendix recommends users update their firmware to the most recent firmware version releases. Users that need more help should contact Bendix directly at info@Bendix.com.
mailto:info@Bendix.com
Vendor fix
EC80ESP+ J1708: Z228999 users should update their firmware to version Z300822.
Vendor fix
EC80ESP+ 6S/6M: Z228999 users should update their firmware to version Z300822.
Vendor fix
EC80ESP+ PLC: Z228999 users should update their firmware to version Z300822.
Vendor fix
EC80ESP+ 2nd CAN: Z228999 users should update their firmware to version Z300822.
Vendor fix
EC80ESP+ Integrated TPMS: Z228999 users should update their firmware to version Z300822.
Vendor fix
EC80ESP 6S/6M: Z266494 users should update their firmware to version Z302578.
Vendor fix
EC80ESP PLC: Z266494 users should update their firmware to version Z302578.
Vendor fix
EC80ESP 2nd CAN: Z266494 users should update their firmware to version Z302578.
Vendor fix
EC80ESP CAN Gateway: Z266494 users should update their firmware to version Z302578.
Vendor fix
EC80ESP 4S/4M: Z286098 users should update their firmware to version Z302579.
Vendor fix
EC80ESP PLC: Z286098 users should update their firmware to version Z302579.
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | \n
| 4.0 | \n7.1 | \nHIGH | \nCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | \n
The affected product uses hard-coded credentials, which could allow an attacker to disable automatic traction control.
\n\nMitigation
Bendix recommends users update their firmware to the most recent firmware version releases. Users that need more help should contact Bendix directly at info@Bendix.com.
mailto:info@Bendix.com
Vendor fix
EC80ESP+ J1708: Z228999 users should update their firmware to version Z300822.
Vendor fix
EC80ESP+ 6S/6M: Z228999 users should update their firmware to version Z300822.
Vendor fix
EC80ESP+ PLC: Z228999 users should update their firmware to version Z300822.
Vendor fix
EC80ESP+ 2nd CAN: Z228999 users should update their firmware to version Z300822.
Vendor fix
EC80ESP+ Integrated TPMS: Z228999 users should update their firmware to version Z300822.
Vendor fix
EC80ESP 6S/6M: Z266494 users should update their firmware to version Z302578.
Vendor fix
EC80ESP PLC: Z266494 users should update their firmware to version Z302578.
Vendor fix
EC80ESP 2nd CAN: Z266494 users should update their firmware to version Z302578.
Vendor fix
EC80ESP CAN Gateway: Z266494 users should update their firmware to version Z302578.
Vendor fix
EC80ESP 4S/4M: Z286098 users should update their firmware to version Z302579.
Vendor fix
EC80ESP PLC: Z286098 users should update their firmware to version Z302579.
Relevant CWE: CWE-798 Use of Hard-coded Credentials
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.4 | \nMEDIUM | \nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L | \n
| 4.0 | \n5.3 | \nMEDIUM | \nCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-08-25 | \n1 | \nInitial Publication | \n
Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized administrative access, disclose sensitive information, modify device configuration, hijack authenticated sessions, and disrupt device operation.
\nThe following versions of Ebyte NE2-D11 are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 9.8 | \nEbyte | \nEbyte NE2-D11 | \nMissing Authentication for Critical Function, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials, Use of Client-Side Authentication, Use of GET Request Method With Sensitive Query Strings, Cross-Site Request Forgery (CSRF), Improper Restriction of Excessive Authentication Attempts, Improper Restriction of Rendered UI Layers or Frames, Missing Authorization | \n
Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker could access sensitive configuration information, modify device settings, or disrupt availability.
\n\nMitigation
Ebyte acknowledged receipt of the reported vulnerabilities and indicated that a patch was under development. However, the vendor has not responded to subsequent requests for coordination, and CISA has not been informed of the status or availability of the patch. Users are encouraged to reach out to Ebyte for more information.
Relevant CWE: CWE-306 Missing Authentication for Critical Function
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
| 4.0 | \n9.3 | \nCRITICAL | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web management interface does not adequately protect sensitive communications using transport-layer encryption. An attacker with access to network traffic could intercept authentication or session-related information transmitted between a user and the affected device. Successful exploitation could result in disclosure of sensitive information and unauthorized access to device management functionality.
\n\nMitigation
Ebyte acknowledged receipt of the reported vulnerabilities and indicated that a patch was under development. However, the vendor has not responded to subsequent requests for coordination, and CISA has not been informed of the status or availability of the patch. Users are encouraged to reach out to Ebyte for more information.
Relevant CWE: CWE-319 Cleartext Transmission of Sensitive Information
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | \n
Administrative credentials may be exposed in plaintext within the Ebyte device's management interface, increasing the risk of credential compromise through visual or remote observation. This undermines the confidentiality of device access.
\n\nMitigation
Ebyte acknowledged receipt of the reported vulnerabilities and indicated that a patch was under development. However, the vendor has not responded to subsequent requests for coordination, and CISA has not been informed of the status or availability of the patch. Users are encouraged to reach out to Ebyte for more information.
Relevant CWE: CWE-522 Insufficiently Protected Credentials
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n4.6 | \nMEDIUM | \nCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | \n
| 4.0 | \n5.1 | \nMEDIUM | \nCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | \n
Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device.
\n\nMitigation
Ebyte acknowledged receipt of the reported vulnerabilities and indicated that a patch was under development. However, the vendor has not responded to subsequent requests for coordination, and CISA has not been informed of the status or availability of the patch. Users are encouraged to reach out to Ebyte for more information.
Relevant CWE: CWE-603 Use of Client-Side Authentication
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
| 4.0 | \n9.3 | \nCRITICAL | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session information to obtain and reuse a valid token. Successful exploitation could allow an attacker to impersonate an authenticated user and gain unauthorized access to device management functionality.
\n\nMitigation
Ebyte acknowledged receipt of the reported vulnerabilities and indicated that a patch was under development. However, the vendor has not responded to subsequent requests for coordination, and CISA has not been informed of the status or availability of the patch. Users are encouraged to reach out to Ebyte for more information.
Relevant CWE: CWE-598 Use of GET Request Method With Sensitive Query Strings
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
| 4.0 | \n9.3 | \nCRITICAL | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management interface. An unauthenticated remote attacker could persuade an authenticated administrator to visit a crafted page, causing unauthorized configuration changes or a disruption of device availability.
\n\nMitigation
Ebyte acknowledged receipt of the reported vulnerabilities and indicated that a patch was under development. However, the vendor has not responded to subsequent requests for coordination, and CISA has not been informed of the status or availability of the patch. Users are encouraged to reach out to Ebyte for more information.
Relevant CWE: CWE-352 Cross-Site Request Forgery (CSRF)
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
| 4.0 | \n8.6 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication.
\n\nMitigation
Ebyte acknowledged receipt of the reported vulnerabilities and indicated that a patch was under development. However, the vendor has not responded to subsequent requests for coordination, and CISA has not been informed of the status or availability of the patch. Users are encouraged to reach out to Ebyte for more information.
Relevant CWE: CWE-307 Improper Restriction of Excessive Authentication Attempts
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | \n
The affected Ebyte device web management interface does not restrict the interface from being rendered within an external frame. An unauthenticated remote attacker could use a crafted webpage to mislead an authenticated administrator into initiating unintended configuration changes or disruptive actions.
\n\nMitigation
Ebyte acknowledged receipt of the reported vulnerabilities and indicated that a patch was under development. However, the vendor has not responded to subsequent requests for coordination, and CISA has not been informed of the status or availability of the patch. Users are encouraged to reach out to Ebyte for more information.
Relevant CWE: CWE-1021 Improper Restriction of Rendered UI Layers or Frames
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.4 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N | \n
| 4.0 | \n5.3 | \nMEDIUM | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N | \n
Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings. This could result in full compromise of device functionality.
\n\nMitigation
Ebyte acknowledged receipt of the reported vulnerabilities and indicated that a patch was under development. However, the vendor has not responded to subsequent requests for coordination, and CISA has not been informed of the status or availability of the patch. Users are encouraged to reach out to Ebyte for more information.
Relevant CWE: CWE-862 Missing Authorization
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | \n
The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality.
\n\nMitigation
Ebyte acknowledged receipt of the reported vulnerabilities and indicated that a patch was under development. However, the vendor has not responded to subsequent requests for coordination, and CISA has not been informed of the status or availability of the patch. Users are encouraged to reach out to Ebyte for more information.
Relevant CWE: CWE-603 Use of Client-Side Authentication
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | \n
MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized device impersonation and disruption of messaging functions.
\n\nMitigation
Ebyte acknowledged receipt of the reported vulnerabilities and indicated that a patch was under development. However, the vendor has not responded to subsequent requests for coordination, and CISA has not been informed of the status or availability of the patch. Users are encouraged to reach out to Ebyte for more information.
Relevant CWE: CWE-319 Cleartext Transmission of Sensitive Information
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n9.8 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | \n
| 4.0 | \n9.3 | \nCRITICAL | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-08-25 | \n1 | \nInitial Publication | \n
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
", "summary_is_html": true, "first_seen": "Mon, 24 Aug 26 12:00:00 +0000", "last_updated": "Mon, 24 Aug 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/alerts/2026/08/21/cisa-adds-one-known-exploited-vulnerability-catalog", "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/alerts/2026/08/21/cisa-adds-one-known-exploited-vulnerability-catalog", "summary": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
", "summary_is_html": true, "first_seen": "Fri, 21 Aug 26 12:00:00 +0000", "last_updated": "Fri, 21 Aug 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-232-01", "title": "Johnson Controls Simplex Incident Manager", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-232-01", "summary": "\nSuccessful exploitation of this vulnerability could allow a local attacker with low privileges to extract user credentials (passwords and authentication tokens) from system memory, potentially leading to unauthorized access to the application and connected systems.
\nThe following versions of Johnson Controls Simplex Incident Manager are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 5.8 | \nJohnson Controls Inc. | \nJohnson Controls Simplex Incident Manager | \nCleartext Storage of Sensitive Information in Memory | \n
The Simplex Incident Manager application stores user credentials (such as passwords and authentication tokens) in an unencrypted form within system memory while running. This exposes sensitive information to potential extraction by anyone with local access to the system, including attackers leveraging memory-dumping tools or insiders with elevated privileges.
\n\nMitigation
Johnson Controls has released a patched version (v2.01.01) to address this vulnerability. To help reduce the risk of exploitation, Johnson Controls suggests considering the following defensive measures: Upgrade the Simplex Incident Manager to version v1.01.05 or later. Restrict local access to systems running the Simplex Incident Manager to authorized personnel only. Implement endpoint protection and monitoring to detect memory-dumping tools or suspicious processes. Enforce strong access control policies and the principle of least privilege on host systems. Utilize full-disk encryption and secure boot to reduce the risk of offline memory analysis. Monitor for unauthorized local access attempts and implement audit logging.
Mitigation
For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-28.
https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
Mitigation
Aligning with CISA recommendations, Johnson Controls recommends taking steps to minimize risks to all building automation systems.
Relevant CWE: CWE-316 Cleartext Storage of Sensitive Information in Memory
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.8 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L | \n
| 4.0 | \n5.8 | \nMEDIUM | \nCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely. This vulnerability has a high attack complexity.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-08-20 | \n1 | \nInitial Republication of Johnson Controls Product Security Advisory JCI-PSA-2026-28 | \n
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
", "summary_is_html": true, "first_seen": "Thu, 20 Aug 26 12:00:00 +0000", "last_updated": "Thu, 20 Aug 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/alerts/2026/08/19/cisa-adds-one-known-exploited-vulnerability-catalog", "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/alerts/2026/08/19/cisa-adds-one-known-exploited-vulnerability-catalog", "summary": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
", "summary_is_html": true, "first_seen": "Wed, 19 Aug 26 12:00:00 +0000", "last_updated": "Wed, 19 Aug 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a", "title": "Defending Against an Active Threat to Siemens S7 Series PLCs", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a", "summary": "Note: This advisory relates to an active threat to Siemens S7 Series programmable logic controllers (PLCs). However, ongoing PLC targeting activity is broader than Siemens PLCs. All PLC owners and operators should apply relevant mitigations to reduce the risk to their devices and systems. The Siemens-specific content in this advisory should be understood and applied as one subset of the wider threat landscape.
\nTop Mitigations
\nThe National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Energy (DOE), and Environmental Protection Agency (EPA)\u2014hereafter referred to as the authoring agencies\u2014are releasing this Cybersecurity Advisory to warn owners and operators of industrial control systems (ICSs) of an active cyber threat to Siemens S7 Series PLCs and provide relevant mitigations to protect and defend them.
\nThe threat actors are conducting reconnaissance and capability development against U.S.-based Siemens PLC installations using AI-generated exploitation scripts disguised as legitimate monitoring tools. The actors leverage Internet scanning services to find Internet-exposed PLCs running outdated software or that are otherwise poorly protected. The U.S. critical infrastructure sectors most targeted by this threat activity include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities. This is not a theoretical risk\u2014it is an active threat. Depending on the specific circumstances, exploitation of poorly protected PLCs could lead to disruption of critical industrial processes, safety incidents, downtime or equipment damage, compromise of sensitive data, compliance violations, and cascading impacts across interconnected systems.
\nThe authoring agencies urge all owners and operators of operational technology (OT) systems using Siemens S7 Series and other PLC devices to proactively check their systems:
\nThese mitigations are particularly important for owners and operators who work with third-party service providers or system integrators who may have remote access to PLCs, as the asset owners may not realize that their systems are exposed and at risk.
\nNote: This advisory uses the MITRE ATT&CK\u00ae Matrix for ICS1 framework, version 19, and the MITRE ATT&CK Matrix for Enterprise framework, version 19. This advisory also uses MITRE D3FENDTM, version 1.5.0. See Appendix A and Appendix B for tables of the activity mapped to MITRE ATT&CK and MITRE D3FEND tactics, techniques, and countermeasures.
\nThreat actors are actively targeting the following Siemens PLC models:
\nThreat actors are using AI assistance to generate exploitation scripts using publicly available information on these Siemens S7 Series PLCs for initial access, credential access, denial of service, and other objectives. If these PLCs are exposed to the Internet or insufficiently segmented, then threat actors can exploit various critical and high severity known vulnerabilities in these PLCs.
\nNote: Using AI to generate exploitation scripts represents an evolution in threat actor capabilities, dramatically reducing the technical expertise and time required to develop working ICS exploitation scripts and malicious tools. In addition, AI enables adversaries to rapidly leverage additional attack vectors and adapt to defensive measures. Threat actors can easily collect public information about vulnerabilities and weaknesses, find exposed and exploitable PLCs, and use AI-generated scripts to act on that information. If PLCs are exposed to the Internet, they are at high risk for exploitation.
\nThreat actors are leveraging open source industrial automation libraries\u2014specifically snap7.dll/python-snap7\u2014combined with AI-assisted scripting to create custom tools that mimic legitimate OT monitoring solutions. These tools provide read/write access to Siemens S7 Series PLC memory, configuration data, and ladder logic programs via the S7comm protocol.
Threat actors are:
\nsnap7.dll library from public repositories [T0834] to gain read/write access to the PLC and mimic legitimate toolsThe authoring agencies assess this activity pattern is likely intended as persistent reconnaissance in targeted sectors and facilities to develop capabilities and prepare to cause operational effects against critical infrastructure. For capability development, actors are testing and refining their exploitation techniques against specific PLC models to improve their ability to compromise the PLCs. To prepare for operational effects, actors are leveraging read access to understand target environments, enabling preparation and positioning for future write operations to cause disruption or other operational impacts.
\nThe U.S. critical infrastructure sectors most targeted by this threat activity include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities. Additionally, Siemens S7 Series PLCs are used in other sectors, including the Defense Industrial Base (DIB), and could be targeted there as well. Unauthorized access to PLCs could result in:
\nSince threat actors are developing capabilities using AI to compromise PLCs using known vulnerabilities, misconfigurations, and other weaknesses and then may use compromised PLCs to interfere with normal operations, the authoring agencies urge organizations to implement comprehensive defense-in-depth strategies, in addition to Common Vulnerabilities and Exposures (CVE) remediation, to protect and defend their PLCs.
\nOrganizations should implement detection strategies and hunt for anomalies that may indicate a compromise, focusing on [D3-PM]:
\n102, repeated connection attempts with varying parameters, or enumeration of CPU propertiesSnap7.dll library usage outside approved engineering workstations, Python scripts with S7comm functionality, or unauthorized monitoring software installationsTo counter threats to PLCs, the authoring agencies recommend all PLC owners and operators follow the mitigations in joint guidance Primary Mitigations to Reduce Cyber Threats to Operational Technology.
\nTo harden Siemens S7 Series PLCs, the authoring agencies strongly urge all owners implement the hardening steps below. Entities that rely on systems integrators or third-party managed service providers should share this advisory with those parties and request implementation of the following mitigations:
\n102)102 at perimeter firewalls entirely102 for connections outside maintenance windowssnap7.dll library imports on engineering workstationsThere is an active threat targeting Internet-exposed Siemens S7 Series PLCs. The combination of known vulnerabilities, accessible exploitation libraries, and AI-assisted development creates a high-probability attack scenario against inadequately protected PLC installations. Organizations should treat this Cybersecurity Advisory with urgency and coordinate response efforts across security, engineering, executive leadership, plant operations, and vendor support teams to implement the recommended detection and hardening actions.
\nU.S. organizations are encouraged to report suspicious or criminal activity related to information in this advisory to CISA and/or the FBI. Contact CISA via CISA\u2019s 24/7 Operations Center at contact@cisa.dhs.gov or 1-844-Say-CISA (1-844-729-2472). File a claim with FBI\u2019s Internet Crime Complaint Center (IC3) or contact your local FBI field office. When available, please include the following information regarding the incident:
\nEntities required to report incidents to DOE should follow established reporting requirements, as appropriate. For other energy sector inquiries, contact EnergySRMA@hq.doe.gov.
\nIn addition, consider contacting Siemens ProductCERT via https://www.siemens.com/cert or email productcert@siemens.com.
\nDisclaimer of endorsement
The information and opinions contained in this document are provided \"as is\" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.
Purpose
This document was developed in furtherance of the authoring agencies\u2019 cybersecurity missions, including their responsibilities to identify and disseminate threats and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.
Contact
Cybersecurity Report Feedback: CybersecurityReports@nsa.gov
Defense Industrial Base Inquiries and Cybersecurity Services: DIB_Defense@cyber.nsa.gov
\nMedia Inquiries / Press Desk: NSA Media Relations: 443-634-0721, MediaRelations@nsa.gov
\nContact Siemens ProductCERT for up-to-date information about the security of Siemens products or to report cybersecurity vulnerabilities at productcert@siemens.com. For support with increasing the security of installed Siemens PLCs, contact Siemens Industrial Cybersecurity Services at services.automation@siemens.com. See Siemens ProductCERT and Siemens CERT for more information.
\nSee Table 1 for the threat actor tactics and techniques referenced in this advisory.
\n| \n Tactic \n | \n\n Technique Title \n | \n\n ID \n | \n\n Use \n | \n
|---|---|---|---|
| Reconnaissance | \nSearch Open Technical Databases: Scan Databases | \nT1596.005 | \nUsing Internet scanning services to identify Internet-exposed or poorly segmented Siemens S7 Series PLCs | \n
| Resource Development | \nDevelop Capabilities: Exploits | \nT1587.004 | \nDeveloping exploits for known Siemens S7 Series PLC vulnerabilities | \n
| Resource Development | \nObtain Capabilities: Artificial Intelligence | \nT1588.007 | \nRapidly iterating exploit code through AI-assisted development | \n
| Execution | \nNative API | \nT0834 | \nDeploying AI-generated Python scripts incorporating the snap7.dll library | \n
| Execution | \nModify Controller Tasking | \nT0821 | \nConducting write operations on data blocks, potentially for pre-positioning for effects operations | \n
| Evasion | \nMasquerading | \nT0849 | \nMasquerading as legitimate monitoring tools to evade detection | \n
| Lateral Movement | \nInsecure Credentials | \nT1694 | \nAccessing exposed devices that have unconfigured (default) or minimally configured authentication | \n
| Collection | \nData from Local System | \nT0893 | \nConducting read operations on data blocks, potentially for reconnaissance | \n
See Table 2 for a mapping of several of the cybersecurity countermeasures mentioned in this advisory.
\n| \n Countermeasure Title \n | \n\n ID \n | \n\n Description \n | \n
|---|---|---|
| Hardware Component Inventory | \nD3-HCI | \nConduct an immediate inventory of all Siemens S7 Series PLCs | \n
| Software Update | \nD3-SU | \nApply critical security patches as soon as possible | \n
| Network Isolation | \nD3-NI | \nVerify network segmentation and ensure PLCs are not accessible from the Internet | \n
| Network Access Mediation | \nD3-NAM | \nRestrict TIA Portal/STEP 7 access to authorized engineering workstations only via MAC/IP allowlisting on PLCs | \n
| Credential Hardening | \nD3-CH | \n\n
| \n
| Platform Monitoring | \nD3-PM | \n\n
| \n
| Network Traffic Analysis | \nD3-NTA | \n\n
| \n
| Application Configuration Hardening | \nD3-ACH | \n\n
| \n
1 MITRE and ATT&CK are registered trademarks of The MITRE Corporation. MITRE D3FEND is a trademark of the MITRE Corporation.
", "summary_is_html": true, "first_seen": "Wed, 19 Aug 26 12:00:00 +0000", "last_updated": "Wed, 19 Aug 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-230-02", "title": "Siemens Simcenter Nastran", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-230-02", "summary": "\nSimcenter Nastran is affected by a stack overflow vulnerability that could be triggered when an application binary reads arbitrary string as a file argument. If a user is tricked to run one of the impacted application binary with a malicious string, an attacker could leverage the vulnerability to perform remote code execution in the context of the current process. Siemens has released new versions for the affected products and recommends to update to the latest versions.
\nThe following versions of Siemens Simcenter Nastran are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.8 | \nSiemens | \nSiemens Simcenter Nastran | \nStack-based Buffer Overflow | \n
The affected applications contain a stack overflow vulnerability while parsing specially strings as argument for one of the application binaries. This could allow an attacker to execute code in the context of the current process.
\n\nVendor fix
Update to V2606 or later version
https://support.sw.siemens.com/product/275652363/
Relevant CWE: CWE-121 Stack-based Buffer Overflow
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-069220 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-08-11 | \n1 | \nPublication Date | \n
| 2026-08-13 | \n2 | \nAdded Simcenter Femap with fix | \n
| 2026-08-18 | \n3 | \nInitial CISA Republication of Siemens ProductCERT SSA-069220 advisory | \n
Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition or execute arbitrary code.
\nThe following versions of CISA Malcolm are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 8.8 | \nCISA | \nCISA Malcolm | \nAllocation of Resources Without Limits or Throttling, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Unrestricted Upload of File with Dangerous Type, Incorrect Authorization, Improper Handling of Highly Compressed Data (Data Amplification) | \n
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat processing container to create an unbounded number of filesystem objects, exhausting inodes or filesystem metadata and denying service to the processing pipeline and any service sharing the same mount. Version 26.07.0 fixes the issue.
\n\nVendor fix
Malcolm version 26.07.0 addresses these issues. For more information, see https://github.com/cisagov/Malcolm/pull/1043. (CVE-2026-63133, CVE-2026-63134, CVE-2026-63177)
https://github.com/cisagov/Malcolm/pull/1043
Relevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
| 4.0 | \n7.1 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | \n
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py protects file extraction with libarchive's secure flags, but creates directory entries with a raw os.makedirs(os.path.join(dest, entry.pathname)) that has no traversal protection. An uploaded malicious archive containing a directory entry with a ../ sequence or an absolute path causes the filebeat processing container to create directories outside the intended extraction directory. Version 26.07.0 fixes the issue.
\n\nVendor fix
Malcolm version 26.07.0 addresses these issues. For more information, see https://github.com/cisagov/Malcolm/pull/1043. (CVE-2026-63133, CVE-2026-63134, CVE-2026-63177)
https://github.com/cisagov/Malcolm/pull/1043
Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.4 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L | \n
| 4.0 | \n5.3 | \nMEDIUM | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N | \n
Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array by default (file-upload/php/config.php:16), so the type check is a no-op and every extension is accepted. The filename sanitizer keeps the .php extension intact. Committed files land in /var/www/upload/server/php/files (file-upload/php/config.php:7), and the component's nginx routes any URL ending in .php to php-fpm. An authenticated GET /server/php/files/.php then executes the uploaded code as www-data. Prior to version 26.06.1, in RBAC mode, the upload endpoint is reachable by the granular ROLE_UPLOAD role (nginx/lua/nginx_auth_helpers.lua:71), a role intended only for submitting capture files. As a result, a user holding the upload-only role runs arbitrary PHP as www-data inside the file-upload container. Version 26.06.1 fixes the issue.
\n\nVendor fix
Malcolm version 26.06.1 addresses this issue. For more information, see https://github.com/cisagov/Malcolm/pull/1026. (CVE-2026-55676)
https://github.com/cisagov/Malcolm/pull/1026
Relevant CWE: CWE-434 Unrestricted Upload of File with Dangerous Type
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | \n
| 4.0 | \n8.7 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.request_uri, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can prepend a traversal segment (for example /x/../upload/...) so that Nginx routes the request to a restricted backend while the Lua role check fails to match any rule and falls open, granting access it should deny. Version 26.07.0 fixes the issue.
\n\nVendor fix
Malcolm version 26.07.0 addresses these issues. For more information, see https://github.com/cisagov/Malcolm/pull/1043. (CVE-2026-63133, CVE-2026-63134, CVE-2026-63177)
https://github.com/cisagov/Malcolm/pull/1043
Relevant CWE: CWE-863 Incorrect Authorization
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.1 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N | \n
| 4.0 | \n7.1 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:L | \n
Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, upload endpoints) by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects which location block actually serves the request using the percent-decoded, normalized URI. Because the RBAC check never percent-decodes its input, an authenticated low-privilege user can request an admin-only path using percent-encoding (e.g. /%68tadmin.php) and have nginx route it to the restricted location while the Lua RBAC gate evaluating the un-decoded raw string finds no matching restriction and grants access.
\n\nVendor fix
Malcolm version 26.08.0 addresses this issue. For more information, see https://github.com/cisagov/Malcolm/security/advisories/GHSA-jr6p-63pg-hr6g. (CVE-2026-19670)
https://github.com/cisagov/Malcolm/security/advisories/GHSA-jr6p-63pg-hr6g
Relevant CWE: CWE-863 Incorrect Authorization
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n5.4 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | \n
| 4.0 | \n5.3 | \nMEDIUM | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | \n
Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits are not applied when the uploaded file is a single-stream compressed format (.gz, .bz2, .xz, .lzma, .lz) that isn't a .tar.*-style archive. Any authenticated user permitted to upload PCAP/log files can upload a small, highly compressible file (e.g. a gzip bomb) that decompresses to an effectively unbounded size on disk, exhausting the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek, and disrupting the platform for all users.
\n\nVendor fix
Malcolm version 26.08.0 addresses this issue. For more information, see https://github.com/cisagov/Malcolm/security/advisories/GHSA-f2v6-8cj4-mhr6. (CVE-2026-19671)
https://github.com/cisagov/Malcolm/security/advisories/GHSA-f2v6-8cj4-mhr6
Relevant CWE: CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.5 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | \n
| 4.0 | \n7.1 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-08-18 | \n1 | \nInitial Publication | \n
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
", "summary_is_html": true, "first_seen": "Tue, 18 Aug 26 12:00:00 +0000", "last_updated": "Tue, 18 Aug 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/alerts/2026/08/17/cisa-adds-one-known-exploited-vulnerability-catalog", "title": "CISA Adds One Known Exploited Vulnerability to Catalog\u00a0", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/alerts/2026/08/17/cisa-adds-one-known-exploited-vulnerability-catalog", "summary": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
\nThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
", "summary_is_html": true, "first_seen": "Mon, 17 Aug 26 12:00:00 +0000", "last_updated": "Mon, 17 Aug 26 12:00:00 +0000" }, { "id": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-13", "title": "Siemens LOGO! Soft Comfort", "source": "CISA Cybersecurity Advisory", "source_url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-13", "summary": "\nSiemens LOGO! Soft Comfort contains multiple vulnerabilities in its project-file encryption and password handling mechanisms. A local attacker could exploit these vulnerabilities to extract the master key, allowing them to decrypt project data or remove project passwords. The lack of password salting enables offline dictionary or brute-force attacks against the password hashes. Successful exploitation could result in unauthorized access to, or modification of, sensitive project logic and configurations. Siemens has released a new version for LOGO! Soft Comfort and recommends to update to the latest version.
\nThe following versions of Siemens LOGO! Soft Comfort are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 6.8 | \nSiemens | \nSiemens LOGO! Soft Comfort | \nUse of Hard-coded Cryptographic Key, Use of a One-Way Hash without a Salt | \n
Affected products use a static, hardcoded AES master key to encrypt project files. This could allow a local attacker to extract the master key from the application files or memory and use it to decrypt project files or remove project passwords entirely without knowing the actual user-defined password.
\n\nVendor fix
Update to V9 or later version Note: A hardware upgrade to LOGO! V9 BM or later is also required to avoid compatibility mode, in which the vulnerabilities addressed by this advisory remain present.
Relevant CWE: CWE-321 Use of Hard-coded Cryptographic Key
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.8 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N | \n
The project password feature in the affected products stores the password as an unsalted SHA-256 hash. This could allow an attacker who has obtained the project file to perform efficient offline dictionary or brute-force attacks against the unsalted hash.
\n\nVendor fix
Update to V9 or later version Note: A hardware upgrade to LOGO! V9 BM or later is also required to avoid compatibility mode, in which the vulnerabilities addressed by this advisory remain present.
Relevant CWE: CWE-759 Use of a One-Way Hash without a Salt
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.8 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N | \n
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-751328 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-08-11 | \n1 | \nPublication Date | \n
| 2026-08-13 | \n2 | \nInitial CISA Republication of Siemens ProductCERT SSA-751328 advisory | \n
Successful exploitation of this vulnerability could allow an attacker within Bluetooth range to manipulate brain stimulation parameters and override safety limits.
\nThe following versions of Flow Neuroscience FL-100 are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 8.1 | \nFlow Neuroscience | \nFlow Neuroscience FL-100 | \nUse of Hard-coded Credentials | \n
An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarilymanipulate brain stimulation parameters and state.
\n\nMitigation
Users are encouraged to install the latest firmware updates provided by Flow Neuroscience via the Flow app.
Relevant CWE: CWE-798 Use of Hard-coded Credentials
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8.1 | \nHIGH | \nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H | \n
| 4.0 | \n7.2 | \nHIGH | \nCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-08-13 | \n1 | \nInitial Publication | \n
Solid Edge is affected by multiple file parsing vulnerabilities that could be triggered when the application reads specially crafted files in PAR, PSM or DFT format. This could allow an attacker to crash the application or execute arbitrary code. Siemens has released new versions for the affected products and recommends to update to the latest versions.
\nThe following versions of Siemens Solid Edge are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.8 | \nSiemens | \nSiemens Solid Edge | \nOut-of-bounds Read, Out-of-bounds Write, Use After Free | \n
The affected applications contains an out of bounds read vulnerability while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process.
\n\nVendor fix
Update to V225.0 Update 15 or later version
https://support.sw.siemens.com/product/246738425/
Vendor fix
Update to V226.0 Update 7 or later version
https://support.sw.siemens.com/product/246738425/
Relevant CWE: CWE-125 Out-of-bounds Read
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
The affected applications contains an out of bounds write vulnerability while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process.
\n\nVendor fix
Update to V225.0 Update 15 or later version
https://support.sw.siemens.com/product/246738425/
Vendor fix
Update to V226.0 Update 7 or later version
https://support.sw.siemens.com/product/246738425/
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
The affected applications contain a use-after-free vulnerability that could be triggered while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process.
\n\nVendor fix
Update to V225.0 Update 15 or later version
https://support.sw.siemens.com/product/246738425/
Vendor fix
Update to V226.0 Update 7 or later version
https://support.sw.siemens.com/product/246738425/
Relevant CWE: CWE-416 Use After Free
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
The affected applications contain a use-after-free vulnerability that could be triggered while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process.
\n\nVendor fix
Update to V225.0 Update 15 or later version
https://support.sw.siemens.com/product/246738425/
Vendor fix
Update to V226.0 Update 7 or later version
https://support.sw.siemens.com/product/246738425/
Relevant CWE: CWE-416 Use After Free
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
The affected applications contains an out of bounds read vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
\n\nVendor fix
Update to V225.0 Update 15 or later version
https://support.sw.siemens.com/product/246738425/
Vendor fix
Update to V226.0 Update 7 or later version
https://support.sw.siemens.com/product/246738425/
Relevant CWE: CWE-125 Out-of-bounds Read
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
The affected applications contains an out of bounds read vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
\n\nVendor fix
Update to V225.0 Update 15 or later version
https://support.sw.siemens.com/product/246738425/
Vendor fix
Update to V226.0 Update 7 or later version
https://support.sw.siemens.com/product/246738425/
Relevant CWE: CWE-125 Out-of-bounds Read
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
The affected applications contains an out of bounds write vulnerability while parsing specially crafted PSM files. This could allow an attacker to execute code in the context of the current process.
\n\nVendor fix
Update to V225.0 Update 15 or later version
https://support.sw.siemens.com/product/246738425/
Vendor fix
Update to V226.0 Update 7 or later version
https://support.sw.siemens.com/product/246738425/
Relevant CWE: CWE-787 Out-of-bounds Write
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.8 | \nHIGH | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | \n
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-621657 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-08-11 | \n1 | \nPublication Date | \n
| 2026-08-13 | \n2 | \nInitial CISA Republication of Siemens ProductCERT SSA-621657 advisory | \n
Successful exploitation of this vulnerability could allow a low-privilege user or attacker to inject a persistent malicious payload via a crafted URL that executes in the context of other users' sessions, including administrators, potentially leading to session hijacking and unauthorized access.
\nThe following versions of Johnson Controls Metasys are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 8 | \nJohnson Controls Inc | \nJohnson Controls Metasys | \nImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | \n
A low-privilege user can inject a malicious XSS payload into the Metasys UI via a crafted URL. The payload persists across logins and executes in the browser context of other users, including administrators.
\n\nMitigation
Johnson Controls recommends the following actions:
Mitigation
User are recommended to apply the latest available patches for affected Metasys versions
Mitigation
Metasys 16.0: Not impacted, fixed prior to release
Vendor fix
Metasys 15.0: Patch released 2026-03-25
Vendor fix
Metasys 14.1.5: Forecast release 2026-07-15
Vendor fix
Metasys 13: End of support, update to later version
Vendor fix
Metasys 12: End of support, update to later version
Mitigation
Metasys 11 & prior: Not affected (vulnerability introduced at version 12)
Mitigation
To help reduce the risk of exploitation, we suggest considering the following defensive measures:
Mitigation
Upgrade to Metasys version 16.0 or apply the latest available patch for your version (15.0.1 or 14.1.5 when available)
Mitigation
Restrict network access to the Metasys UI to trusted networks and users only; do not expose the interface directly to the internet
Mitigation
Implement network segmentation to isolate building automation systems from the corporate IT network
Mitigation
Enforce least-privilege access controls \u2013 limit user accounts to the minimum permissions necessary
Mitigation
Implement Content Security Policy (CSP) headers and other HTTP security headers where possible at the network/proxy level
Mitigation
Monitor for suspicious URL patterns and unexpected script execution in Metasys UI access logs
Mitigation
Use a web application firewall (WAF) in front of the Metasys UI to detect and block common XSS payloads
Mitigation
Educate users to avoid clicking on untrusted or unexpected links that target the Metasys UI
Mitigation
For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-11 at the following location: Security Advisories.
Relevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n8 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H | \n
| 4.0 | \n8.6 | \nHIGH | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-08-13 | \n1 | \nInitial Publication. | \n
Successful exploitation of this vulnerability could allow an attacker to tamper with serialized data, potentially resulting in code execution during deserialization.
\nThe following versions of AVEVA Enterprise SCADA are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.1 | \nAVEVA | \nAVEVA Enterprise SCADA | \nDeserialization of Untrusted Data | \n
The vulnerability, if exploited, could allow an authenticated miscreant with \"DNA Authority - Operator\" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Enterprise SCADA security group \"DNA Apps\".
\n\nMitigation
AVEVA recommends that customers using affected product versions should perform the following to mitigate the risk of exploit: 1. Evaluate the impact of these vulnerabilities based on your operational environment, architecture, and product implementation. 2. Plan an upgrade of Servers and Clients to one of the available fixed versions listed in this document. 3. Configure Servers and Clients as described in this document.
Mitigation
Contact your AVEVA Technical Support representative, Customer Success Manager, Account Manager, or Solution Integrator to obtain the security update best applicable to the product version currently deployed in your environment: Servers: AVEVA Enterprise SCADA v2025 P1 or higher, AVEVA Enterprise SCADA v2024 SP1 P2, AVEVA Enterprise SCADA v2023 SP1 P1, AVEVA Enterprise SCADA v2022 SP2 P3, AVEVA Enterprise SCADA v2021 SP2 P6, AVEVA Pipeline Operations for Gas/Liquids v2025 P1 or higher, AVEVA Pipeline Operations for Gas/Liquids v2024 SP1 P2, AVEVA Pipeline Operations for Gas/Liquids v2023 SP1 P1, AVEVA Pipeline Operations for Gas/Liquids v2022 SP2 P3, AVEVA Pipeline Operations for Gas/Liquids v2021 SP2 P6 Clients: AVEVA Enterprise SCADA HMI v2024 R2 HF7 or higher, AVEVA Enterprise SCADA HMI v2024 P1, AVEVA Enterprise SCADA HMI v2023 P2 HF1, AVEVA Pipeline Integrity Monitor (delivered on Pipeline Simulation media) v2025 SP1 P2 or higher, AVEVA Pipeline Training Simulator (delivered on Pipeline Simulation media) v2025 SP1 P2 or higher, Measurement Advisor 2025 P1 or higher, Measurement Advisor 2021 SP1 HF16
Mitigation
To fully mitigate the risk of exploit, the following configuration changes must be implemented after all server and client nodes have been upgraded to compatible versions that support the fix:Server Components: Change \"BinarySerializer\" -> \"Mode\" setting from 'Binary Formatter' to 'Json'. Change \"BinarySerializer\" -> \"AcceptBinaryFormattedData\" setting from 'true' to 'false'. Re-cache the XOS Event Handlers assembly
Mitigation
Client Components: Configure clients/products that interface with Enterprise SCADA to only use JSON serialization.
Mitigation
HMI: Migrate HMI displays
Mitigation
For step-by-step instructions on where and how to apply these configuration settings, how to migrate HMI displays, compatible server-client versions list, and additional details please refer to KB117814 \"AVEVA Midstream Product Bulletin - Removal of Binary Formatter\"
https://softwaresupportsp.aveva.com/en-US/knowledge/details/000117814?lang=en_US
Mitigation
AVEVA recommends the following general defensive measures: Audit devices, network topology, and perimeter defences to ensure all applicable security best practices from AVEVA's Enterprise SCADA Reference System Architecture are adhered to. Audit assigned permissions to ensure that only trusted users are given \"DNA Authority - Operator\" rights: https://docs.aveva.com/bundle/scada-ent-2025/page/651008.html Disallow BLT Test clients in production environmentsFor additional details on defensive measures, refer to Section 5 of KB117814 \"AVEVA Midstream Product Bulletin - Removal of Binary Formatter
https://docs.aveva.com/bundle/scada-ent-2025/page/651008.html
Mitigation
For more information on this vulnerability, including security updates, users should see the security bulletin AVEVA-2026-005.
https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2026-005.pdf
Relevant CWE: CWE-502 Deserialization of Untrusted Data
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.1 | \nHIGH | \nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H | \n
| 4.0 | \n6.1 | \nMEDIUM | \nCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks. Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability has a high attack complexity.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-08-13 | \n1 | \nInitial Republication of AVEVA security bulletin AVEVA-2026-005 | \n
Successful exploitation of this vulnerability may allow an attacker to inject and execute arbitrary OS commands with root privileges.
\nThe following versions of Haiwell IoT Cloud HMI Gateway are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 10 | \nHaiwell | \nHaiwell IoT Cloud HMI Gateway | \nImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | \n
A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system, allowing an attacker to inject and execute arbitrary OS commands with root privileges
\n\nMitigation
Haiwell has addressed the issue in patch version number Scada-v3.50.1.19, which is available for download on their website: https://en.haiwell.com/app/system/entrance.php?m=include&c=access&a=dodown&lang=en&id=361
https://en.haiwell.com/app/system/entrance.php?m=include&c=access&a=dodown&lang=en&id=361
Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n10 | \nCRITICAL | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | \n
| 4.0 | \n10 | \nCRITICAL | \nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nNo known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-08-13 | \n1 | \nInitial Publication | \n
Successful exploitation of these vulnerabilities could allow an attacker to decrypt sensitive data, bypass authentication controls, gaining unauthorized access to read arbitrary files on the system, or gain unauthorized access to protected system resources.
\nThe following versions of Johnson Controls Inc. Airwall are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 6.8 | \nJohnson Controls Inc. | \nJohnson Controls Inc. Airwall | \nUse of Hard-coded Cryptographic Key, External Control of File Name or Path | \n
A hardcoded password or cryptographic key was identified in the Airwall application. A hardcoded credential leads to a significant authentication failure that can be difficult for system or application administrators to detect. Once discovered, it is difficult to remediate without manually modifying or patching the software. The hardcoded key is identical across all installations of the product and across all customer organizations, meaning a single disclosure of the key - common on the internet - grants any knowledgeable attacker access to all affected deployments. An attacker with access to application code or binary files can use the hardcoded key to decrypt sensitive application data stored in configuration and database files, enabling further data disclosure or compromise of application infrastructure.
\n\nMitigation
To help reduce risk of exploitation, Johnson Controls recommends the following defensive measures: Apply v4.1.0 or later patches for all Airwalls.
Mitigation
Store all cryptographic keys in a secure key management system (KMS) or hardware security module (HSM) rather than embedding them in source code or configuration files. (CVE-2026-64887)
Mitigation
Implement a regular key rotation policy to limit the exposure window if a key is compromised. (CVE-2026-64887)
Mitigation
Use unique cryptographic keys per device, installation, or deployment instance to prevent a single compromised key from affecting all installations. (CVE-2026-64887)
Mitigation
Remove any hard-coded keys from source code repositories and binaries, replacing them with references to secure external key stores. (CVE-2026-64887)Apply the principle of least privilege to key access, ensuring only authorized processes and personnel can retrieve cryptographic material. (CVE-2026-64887)
Mitigation
Use static analysis and secrets-scanning tools in CI/CD pipelines to detect and prevent hard-coded keys from being committed to source control. (CVE-2026-64887)
Mitigation
Encrypt keys at rest and in transit and ensure key-wrapping mechanisms are in place for any keys stored on disk. (CVE-2026-64887)
Mitigation
Audit and monitor access to cryptographic keys, logging all retrieval and usage events for anomaly detection. (CVE-2026-64887)
Mitigation
Refer to and follow all steps in the product hardening guide or the JCI universal hardening guide found here https://www.johnsoncontrols.com/trust-center/cybersecurity/resources (CVE-2026-64887)
https://www.johnsoncontrols.com/trust-center/cybersecurity/resources
Mitigation
For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-25 at the following location: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories (CVE-2026-64887)
https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
Relevant CWE: CWE-321 Use of Hard-coded Cryptographic Key
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.8 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N | \n
| 4.0 | \n7 | \nHIGH | \nCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N | \n
An arbitrary file read vulnerability was identified in the Airwall application. This issue occurs when user-supplied input is directly incorporated into filesystem access functions without adequate validation or sanitization. As a result, an attacker can request and obtain the contents of arbitrary files on the server, including sensitive configuration files, source code, credential stores, and private keys, provided the application process has permission to read them. The vulnerability is commonly exploited through path traversal sequences (e.g., ../) or absolute file paths (e.g., /etc/passwd). Encoding variations of traversal sequences (e.g., %2e%2e%2f) can also bypass basic filters.
\n\nMitigation
To help reduce risk of exploitation, Johnson Controls recommends the following defensive measures: Apply v4.1.0 or later patches for all Airwalls.
Mitigation
Validate and sanitize all user-supplied input before using it in file system operations (CVE-2026-34492)
Mitigation
Implement strict allowlists for permitted file paths, file names, and directories (CVE-2026-34492)
Mitigation
Use canonicalization to resolve path traversal sequences before validation (CVE-2026-34492)
Mitigation
Apply the principle of least privilege to the application file system access permissions (CVE-2026-34492)
Mitigation
Deploy sandboxing or chroot jails to restrict the application's file system scope (CVE-2026-34492)
Mitigation
Avoid passing user-controlled data directly to file system APIs (CVE-2026-34492)
Mitigation
Refer to and follow all steps in the product hardening guide or the JCI universal hardening guide found here https://www.johnsoncontrols.com/trust-center/cybersecurity/resources (CVE-2026-34492)
https://www.johnsoncontrols.com/trust-center/cybersecurity/resources
Mitigation
For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-18 at the following location: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories (CVE-2026-34492)
https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
Relevant CWE: CWE-73 External Control of File Name or Path
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6.4 | \nMEDIUM | \nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L | \n
| 4.0 | \n5.9 | \nMEDIUM | \nCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N | \n
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
\nMinimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolating them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:
\nDo not click web links or open attachments in unsolicited email messages.
\nRefer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
\nRefer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
\nNo known public exploitation specifically targeting this (these) vulnerability(ies) has been reported to CISA at this time. This (these) vulnerability(ies) is (are) not exploitable remotely. This (these) vulnerability(ies) has (have) a high attack complexity.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-08-13 | \n1 | \nInitial Republication of Johnson Controls JCI-PSA-2026-18 and JCI-PSA-2026-25 | \n
A vulnerability in Desigo DXR and PXC controllers has been identified that could allow an attacker to cause denial of service conditions by sending malformed BACnet packets. Recovery requires a device reset or reboot to restore normal functionality. Siemens has released new versions for the affected products and recommends to update to the latest versions.
\nThe following versions of Siemens Desigo DXR and PXC Controllers are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 4.3 | \nSiemens | \nSiemens Desigo DXR and PXC Controllers | \nImproper Check for Unusual or Exceptional Conditions | \n
The affected devices are vulnerable to a denial-of-service (DoS) vulnerability. An attacker can exploit this issue by sending a malformed BACnet packet, causing the device to stop responding to BACnet queries. Recovery requires a device reset or reboot to restore normal functionality.
\n\nVendor fix
Update to V01.21.233.16-7862 or later version Please contact your local Siemens office for additional support in obtaining the update.
Vendor fix
Update to V02.21.194.36-2715 or later version Please contact your local Siemens office for additional support in obtaining the update.
Relevant CWE: CWE-754 Improper Check for Unusual or Exceptional Conditions
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n4.3 | \nMEDIUM | \nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | \n
As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and following the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens SSA-781903 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-08-11 | \n1 | \nPublication Date | \n
| 2026-08-13 | \n2 | \nInitial CISA Republication of Siemens SSA-781903 advisory | \n
Siemens License Server is affected by multiple vulnerabilities which could allow an attacker to elevate its privileges and read arbitrary files on the system. Siemens has released a new version for Siemens License Server (SLS) and recommends to update to the latest version.
\nThe following versions of Siemens License Server (SLS) are affected:
\n| CVSS | \nVendor | \nEquipment | \nVulnerabilities | \n
|---|---|---|---|
| v3 7.5 | \nSiemens | \nSiemens License Server (SLS) | \nIncorrect Permission Assignment for Critical Resource, Path Traversal: '.../...//' | \n
The affected application is vulnerable to a local privilege escalation due to an insecure sudoers policy. This could allow an attacker to execute arbitrary commands and plant malicious files as root, leading to full system compromise.
\n\nVendor fix
Update to V5.1 or later version
https://support.sw.siemens.com/product/1586485382/
Relevant CWE: CWE-732 Incorrect Permission Assignment for Critical Resource
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n6 | \nMEDIUM | \nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N | \n
The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application.
\n\nVendor fix
Update to V5.3 or later version
https://support.sw.siemens.com/product/1586485382/
Relevant CWE: CWE-35 Path Traversal: '.../...//'
\n| CVSS Version | \nBase Score | \nBase Severity | \nVector String | \n
|---|---|---|---|
| 3.1 | \n7.5 | \nHIGH | \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | \n
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
\nCISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.
\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-077553 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
\n| Date | \nRevision | \nSummary | \n
|---|---|---|
| 2026-08-11 | \n1 | \nPublication Date | \n
| 2026-08-13 | \n2 | \nInitial CISA Republication of Siemens ProductCERT SSA-077553 advisory | \n