CyberWatch Newsroom Live Intel

Important CISA Advisory

2026-10-22 CISA Advisory

Siemens APOGEE, TALON and Desigo PXC/PXM Products

View CSAF Summary The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens APOGEE, TALON and Desigo PXC/PXM Products are affected: APOGEE MBC (PPC) (BACnet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE MBC (PPC) (P2 Ethernet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE MEC (PPC) (BACnet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE MEC (PPC) (P2 Ethernet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE PXC Compact (BACnet) vers:intdot/ APOGEE PXC Compact (P2 Ethernet) vers:intdot/ APOGEE PXC Modular (BACnet) vers:intdot/ APOGEE PXC Modular (P2 Ethernet) vers:intdot/ Desigo PXC00-E.D vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXC00-U vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXC001-E.D vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXC100-E.D vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXC12-E.D vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXC128-U vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXC200-E.D vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXC22-E.D vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXC22.1-E.D vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXC36.1-E.D vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXC50-E.D vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXC64-U vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXM20-E vers:intdot/>=2.3 (CVE-2026-89208) TALON TC Compact (BACnet) vers:intdot/ TALON TC Modular (BACnet) vers:intdot/ CVSS Vendor Equipment v3 8.2 Siemens APOGEE MBC (PPC) (BACnet) 3 Vulnerabilities Out-of-bounds Read, Integer Underflow (Wrap or Wraparound), Stack-based Buffer Overflow Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2026-89208 The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries. Read More 13 Affected Products Desigo PXC00-U >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC001-E.D >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC100-E.D >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC12-E.D >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC128-U >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC200-E.D >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC22-E.D >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC22.1-E.D >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC36.1-E.D >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC50-E.D >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC64-U >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXM20-E >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC00-E.D >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Additional Metrics Relevant CWE: CWE-125 Out-of-bounds Read CVSS Version Base Score Base Severity Vector String 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N View CVE Details CVE-2026-102073 The affected product web service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to read portions of device memory or to cause a denial-of-service condition. Read More 23 Affected Products Desigo PXC00-U >= V2.3 Product Status: known_affected Remediations Desigo PXC001-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC100-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC12-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC128-U >= V2.3 Product Status: known_affected Remediations Desigo PXC200-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC22-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC22.1-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC36.1-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC50-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC64-U >= V2.3 Product Status: known_affected Remediations Desigo PXM20-E >= V2.3 Product Status: known_affected Remediations Desigo PXC00-E.D >= V2.3 Product Status: known_affected Remediations APOGEE MBC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MBC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned TALON TC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version TALON TC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE MEC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MEC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE PXC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Compact (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE PXC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Modular (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version Additional Metrics Relevant CWE: CWE-191 Integer Underflow (Wrap or Wraparound) CVSS Version Base Score Base Severity Vector String 3.1 8.2 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L View CVE Details CVE-2026-102074 The affected product FTP service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to cause a denial of service. Read More 33 Affected Products Desigo PXC00-U >= V2.3 Product Status: known_affected Remediations Desigo PXC001-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC100-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC12-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC128-U >= V2.3 Product Status: known_affected Remediations Desigo PXC200-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC22-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC22.1-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC36.1-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC50-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC64-U >= V2.3 Product Status: known_affected Remediations Desigo PXM20-E >= V2.3 Product Status: known_affected Remediations Desigo PXC00-E.D >= V2.3 Product Status: known_affected Remediations APOGEE MBC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MBC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned TALON TC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version TALON TC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE MEC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MEC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE PXC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Compact (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE PXC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Modular (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE MBC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MBC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned TALON TC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version TALON TC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE MEC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MEC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE PXC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Compact (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE PXC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Modular (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version Additional Metrics Relevant CWE: CWE-121 Stack-based Buffer Overflow CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H View CVE Details CVE-2026-102075 The affected product web service does not properly validate user input in multipart handling. This could allow an unauthenticated remote attacker to cause a denial of service. Read More 43 Affected Products Desigo PXC00-U >= V2.3 Product Status: known_affected Remediations Desigo PXC001-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC100-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC12-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC128-U >= V2.3 Product Status: known_affected Remediations Desigo PXC200-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC22-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC22.1-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC36.1-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC50-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC64-U >= V2.3 Product Status: known_affected Remediations Desigo PXM20-E >= V2.3 Product Status: known_affected Remediations Desigo PXC00-E.D >= V2.3 Product Status: known_affected Remediations APOGEE MBC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MBC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned TALON TC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version TALON TC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE MEC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MEC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE PXC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Compact (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE PXC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Modular (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE MBC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MBC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned TALON TC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version TALON TC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE MEC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MEC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE PXC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Compact (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE PXC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Modular (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE MBC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MBC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned TALON TC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version TALON TC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE MEC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MEC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE PXC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Compact (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE PXC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Modular (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version Additional Metrics Relevant CWE: CWE-121 Stack-based Buffer Overflow CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H View CVE Details CVE-2026-102076 The affected product web service does not properly validate user-supplied input in upload code. This could allow an unauthenticated remote attacker to cause a denial of service. Read More 53 Affected Products Desigo PXC00-U >= V2.3 Product Status: known_affected Remediations Desigo PXC001-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC100-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC12-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC128-U >= V2.3 Product Status: known_affected Remediations Desigo PXC200-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC22-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC22.1-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC36.1-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC50-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC64-U >= V2.3 Product Status: known_affected Remediations Desigo PXM20-E >= V2.3 Product Status: known_affected Remediations Desigo PXC00-E.D >= V2.3 Product Status: known_affected Remediations APOGEE MBC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MBC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned TALON TC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version TALON TC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE MEC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MEC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE PXC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Compact (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE PXC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Modular (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE MBC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MBC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned TALON TC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version TALON TC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE MEC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MEC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE PXC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Compact (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE PXC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Modular (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE MBC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MBC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned TALON TC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version TALON TC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE MEC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MEC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE PXC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Compact (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE PXC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Modular (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE MBC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MBC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned TALON TC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version TALON TC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE MEC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MEC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE PXC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Compact (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE PXC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Modular (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version Additional Metrics Relevant CWE: CWE-121 Stack-based Buffer Overflow CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H View CVE Details Acknowledgments Siemens ProductCERT reported these vulnerabilities to CISA. General Recommendations As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment. Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet . Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-333035 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-13 Date Revision Summary 2026-10-13 1 Publication Date 2026-10-22 2 Initial CISA Republication of Siemens ProductCERT SSA-333035 advisory Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-22 CISA Advisory

Siemens Industrial Edge Devices

View CSAF Summary Siemens Industrial Edge Devices contain multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens Industrial Edge Devices are affected: Industrial Edge Cloud Device (IECD) vers:intdot/ Industrial Edge Own Device (IEOD) vers:intdot/ Industrial Edge Virtual Device (IEVD) vers:intdot/ SCALANCE LPE9413 (6GK5998-3GS01-2AC2) vers:all/* (CVE-2026-44414) SCALANCE LPE9433 (6GK5998-3GS11-2AC2) vers:all/* (CVE-2026-44414) SIMATIC HMI MTP1000 Unified Comfort Panel (6AV2128-3KB06-0AX1) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1000 Unified Comfort Panel hygienic (6AV2128-3KB40-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design (6AV2128-3KB70-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1000, Unified Comfort Panel neutral (6AV2128-3KB36-0AX1) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3MB27-1BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3MB27-0BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3MB27-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3MB57-1BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3MB57-0BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3MB57-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1200 Unified Comfort Panel (6AV2128-3MB06-0AX1) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1200 Unified Comfort Panel hygienic (6AV2128-3MB40-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design (6AV2128-3MB70-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1200 Unified Comfort Panel neutral design (6AV2128-3MB36-0AX1) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3QB27-1BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3QB27-0BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3QB27-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3QB57-1BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3QB57-0BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3QB57-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1500 Unified Comfort Panel (6AV2128-3QB06-0AX1) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1500 Unified Comfort Panel hygienic (6AV2128-3QB40-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design (6AV2128-3QB70-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1500 Unified Comfort Panel neutral design (6AV2128-3QB36-0AX1) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3UB27-1BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3UB27-0BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3UB27-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1900 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3UB57-1BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3UB57-0BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3UB57-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1900 Unified Comfort Panel (6AV2128-3UB06-0AX1) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1900 Unified Comfort Panel hygienic (6AV2128-3UB40-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1900 Unified Comfort Panel hygienic neutral design (6AV2128-3UB70-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1900 Unified Comfort Panel neutral design (6AV2128-3UB36-0AX1) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP2200 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3XB27-1BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP2200 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3XB27-0BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP2200 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3XB27-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP2200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3XB57-1BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3XB57-0BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3XB57-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP2200 Unified Comfort Hygienic (6AV2128-3XB40-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP2200 Unified Comfort Hygienic neutral design (6AV2128-3XB70-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP2200 Unified Comfort Panel (6AV2128-3XB06-0AX1) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP2200 Unified Comfort Panel neutral design (6AV2128-3XB36-0AX1) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP700 Unified Comfort Panel (6AV2128-3GB06-0AX1) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (6AV2128-3GB40-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (6AV2128-3GB70-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP700, Unified Comfort Panel neutral design (6AV2128-3GB36-0AX1) vers:all/* (CVE-2026-44415) SIMATIC IoT2050 Advanced IED (6ES7647-0BW00-1YA2) vers:intdot/ SIMATIC IoT2050 SM IED (6ES7647-0CW00-1AA2) vers:intdot/ SIMATIC IPC BX-21A Industrial Edge Device vers:intdot/ SIMATIC IPC BX-39A Industrial Edge Device vers:intdot/ SIMATIC IPC BX-59A Industrial Edge Device vers:intdot/ SIMATIC IPC127E Industrial Edge Device vers:intdot/ SIMATIC IPC227E Industrial Edge Device vers:intdot/ SIMATIC IPC227G Industrial Edge Device vers:intdot/ SIMATIC IPC427E Industrial Edge Device vers:intdot/ SIMATIC IPC847E Industrial Edge Device vers:intdot/ SIPLUS HMI MTP1000 Unified Comfort (6AG1128-3KB06-4AX1) vers:all/* (CVE-2026-44415) SIPLUS HMI MTP1200 Unified Comfort (6AG1128-3MB06-4AX1) vers:all/* (CVE-2026-44415) SIPLUS HMI MTP700 Unified Comfort (6AG1128-3GB06-4AX1) vers:all/* (CVE-2026-44415) CVSS Vendor Equipment v3 9.1 Siemens Industrial Edge Cloud Device (IECD) 1 Vulnerability Path Traversal: '.../...//' Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2026-44414 Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system. Read More 15 Affected Products Industrial Edge Cloud Device (IECD) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V1.28.1 or later version Industrial Edge Own Device (IEOD) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V1.28.1 or later version Industrial Edge Virtual Device (IEVD) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V1.28.1 or later version SCALANCE LPE9413 (6GK5998-3GS01-2AC2) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SCALANCE LPE9433 (6GK5998-3GS11-2AC2) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC IoT2050 Advanced IED (6ES7647-0BW00-1YA2) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V1.28.1-2 or later version SIMATIC IoT2050 SM IED (6ES7647-0CW00-1AA2) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V1.28.1-2 or later version SIMATIC IPC BX-21A Industrial Edge Device Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V1.28.1-2 or later version SIMATIC IPC BX-39A Industrial Edge Device Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V3.2.0-17 or later version SIMATIC IPC BX-59A Industrial Edge Device Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V3.2.0-17 or later version SIMATIC IPC127E Industrial Edge Device Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V3.2.0-17 or later version SIMATIC IPC227E Industrial Edge Device Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V3.2.0-17 or later version SIMATIC IPC227G Industrial Edge Device Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V3.2.0-17 or later version SIMATIC IPC427E Industrial Edge Device Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V3.2.0-17 or later version SIMATIC IPC847E Industrial Edge Device Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V3.2.0-17 or later version Additional Metrics Relevant CWE: CWE-35 Path Traversal: '.../...//' CVSS Version Base Score Base Severity Vector String 3.1 6.8 MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N View CVE Details CVE-2026-44415 Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data. Read More 66 Affected Products Industrial Edge Cloud Device (IECD) Product Status: known_affected Remediations Industrial Edge Own Device (IEOD) Product Status: known_affected Remediations Industrial Edge Virtual Device (IEVD) Product Status: known_affected Remediations SCALANCE LPE9413 (6GK5998-3GS01-2AC2) Product Status: known_affected Remediations SCALANCE LPE9433 (6GK5998-3GS11-2AC2) Product Status: known_affected Remediations SIMATIC IoT2050 Advanced IED (6ES7647-0BW00-1YA2) Product Status: known_affected Remediations SIMATIC IoT2050 SM IED (6ES7647-0CW00-1AA2) Product Status: known_affected Remediations SIMATIC IPC BX-21A Industrial Edge Device Product Status: known_affected Remediations SIMATIC IPC BX-39A Industrial Edge Device Product Status: known_affected Remediations SIMATIC IPC BX-59A Industrial Edge Device Product Status: known_affected Remediations SIMATIC IPC127E Industrial Edge Device Product Status: known_affected Remediations SIMATIC IPC227E Industrial Edge Device Product Status: known_affected Remediations SIMATIC IPC227G Industrial Edge Device Product Status: known_affected Remediations SIMATIC IPC427E Industrial Edge Device Product Status: known_affected Remediations SIMATIC IPC847E Industrial Edge Device Product Status: known_affected Remediations SIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3MB27-1BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3MB27-0BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3MB27-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3MB57-1BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3MB57-0BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3MB57-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1200 Unified Comfort Panel (6AV2128-3MB06-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1200 Unified Comfort Panel hygienic (6AV2128-3MB40-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design (6AV2128-3MB70-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1200 Unified Comfort Panel neutral design (6AV2128-3MB36-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3QB27-1BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3QB27-0BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3QB27-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3QB57-1BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3QB57-0BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3QB57-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1500 Unified Comfort Panel (6AV2128-3QB06-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1500 Unified Comfort Panel hygienic (6AV2128-3QB40-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design (6AV2128-3QB70-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1500 Unified Comfort Panel neutral design (6AV2128-3QB36-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3UB27-1BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3UB27-0BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3UB27-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1900 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3UB57-1BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3UB57-0BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3UB57-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1900 Unified Comfort Panel (6AV2128-3UB06-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1900 Unified Comfort Panel hygienic (6AV2128-3UB40-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1900 Unified Comfort Panel hygienic neutral design (6AV2128-3UB70-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1900 Unified Comfort Panel neutral design (6AV2128-3UB36-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP2200 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3XB27-1BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP2200 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3XB27-0BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP2200 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3XB27-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP2200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3XB57-1BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3XB57-0BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3XB57-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP2200 Unified Comfort Hygienic (6AV2128-3XB40-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP2200 Unified Comfort Hygienic neutral design (6AV2128-3XB70-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP2200 Unified Comfort Panel (6AV2128-3XB06-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP2200 Unified Comfort Panel neutral design (6AV2128-3XB36-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP700 Unified Comfort Panel (6AV2128-3GB06-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (6AV2128-3GB40-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (6AV2128-3GB70-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP700, Unified Comfort Panel neutral design (6AV2128-3GB36-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1000 Unified Comfort Panel (6AV2128-3KB06-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIPLUS HMI MTP1000 Unified Comfort (6AG1128-3KB06-4AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIPLUS HMI MTP1200 Unified Comfort (6AG1128-3MB06-4AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIPLUS HMI MTP700 Unified Comfort (6AG1128-3GB06-4AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1000 Unified Comfort Panel hygienic (6AV2128-3KB40-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design (6AV2128-3KB70-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1000, Unified Comfort Panel neutral (6AV2128-3KB36-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available Additional Metrics Relevant CWE: CWE-35 Path Traversal: '.../...//' CVSS Version Base Score Base Severity Vector String 3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H View CVE Details Acknowledgments Siemens ProductCERT reported these vulnerabilities to CISA. General Recommendations As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet . Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-832641 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-13 Date Revision Summary 2026-10-13 1 Publication Date 2026-10-22 2 Initial CISA Republication of Siemens ProductCERT SSA-832641 advisory Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-22 CISA Advisory

Siemens Software Center

View CSAF Summary The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Siemens has released a new version for Siemens Software Center and recommends to update to the latest version. Please refer to our blog post for additional information about current known active exploitation and how to detect it. The following versions of Siemens Software Center are affected: Siemens Software Center vers:intdot/ CVSS Vendor Equipment v3 6.7 Siemens Siemens Software Center 1 Vulnerability Uncontrolled Search Path Element Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities CVE-2026-110936 The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Read More 1 Affected Product Siemens Software Center Product Status: known_affected Remediations Vendor fix Update to V4.0.9.8 or later version (All existing versions of SSC will be auto updated on next startup. The latest version can also be downloaded in the respective link) Additional Metrics Relevant CWE: CWE-427 Uncontrolled Search Path Element CVSS Version Base Score Base Severity Vector String 3.1 6.7 MEDIUM CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H View CVE Details Acknowledgments Siemens ProductCERT reported this vulnerability to CISA. General Recommendations As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet . Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-580366 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-15 Date Revision Summary 2026-10-15 1 Publication Date 2026-10-17 2 Added remediation for Siemens Software Center 2026-10-19 3 Added reference to blog post about active exploitation of the vulnerability 2026-10-22 4 Initial CISA Republication of Siemens ProductCERT SSA-580366 advisory Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-22 CISA Advisory

Siemens RUGGEDCOM APE1808 Devices

View CSAF Summary Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens recommends to contact customer support to receive patch and update information. The following versions of Siemens RUGGEDCOM APE1808 Devices are affected: RUGGEDCOM APE1808 vers:all/* (CVE-2026-33387, CVE-2026-33388, CVE-2026-33389, CVE-2026-33391, CVE-2026-33920) CVSS Vendor Equipment v3 7.5 Siemens RUGGEDCOM APE1808 4 Vulnerabilities Improper Neutralization of Special Elements Used in a Template Engine, Incorrect Authorization, Lack of Administrator Control over Security, Cross-Site Request Forgery (CSRF) Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2026-33387 A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a malicious dashboard. When the victim views or imports the dashboard, the payload executes in their browser context, allowing the attacker to modify application data or disrupt application availability. Read More 1 Affected Product RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information Additional Metrics Relevant CWE: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine CVSS Version Base Score Base Severity Vector String 3.1 4.6 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L View CVE Details CVE-2026-33388 An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual credential values are not directly visible, but the user can delete entries or edit their properties. An attacker who deletes or edits an entry can disrupt authentication for dependent devices, and one who manipulates an entry's configuration may be able to indirectly obtain the credentials. Read More 2 Affected Products RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information Additional Metrics Relevant CWE: CWE-863 Incorrect Authorization CVSS Version Base Score Base Severity Vector String 3.1 7.4 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L View CVE Details CVE-2026-33389 An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device's data and to disrupt its operations. Read More 3 Affected Products RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information Additional Metrics Relevant CWE: CWE-671 Lack of Administrator Control over Security CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L View CVE Details CVE-2026-33391 An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart Polling discovery configuration. This allows the attacker to disrupt the visibility of assets in the monitored network. Read More 4 Affected Products RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information Additional Metrics Relevant CWE: CWE-863 Incorrect Authorization CVSS Version Base Score Base Severity Vector String 3.1 5.4 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L View CVE Details CVE-2026-33920 A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performed by the victim in this state is attributed to the attacker's account, compromising the integrity of the audit trail. Read More 5 Affected Products RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information Additional Metrics Relevant CWE: CWE-352 Cross-Site Request Forgery (CSRF) CVSS Version Base Score Base Severity Vector String 3.1 3.5 LOW CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N View CVE Details Acknowledgments Siemens ProductCERT reported these vulnerabilities to CISA. General Recommendations As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet . Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-911336 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-13 Date Revision Summary 2026-10-13 1 Publication Date 2026-10-22 2 Initial CISA Republication of Siemens ProductCERT SSA-911336 advisory Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-22 CISA Advisory

Siemens SIMATIC S7-1500 TM MFP

View CSAF Summary Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens SIMATIC S7-1500 TM MFP are affected: SIMATIC S7-1500 TM MFP - GNU/Linux subsystem vers:all/* CVSS Vendor Equipment v3 10 Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem 377 Vulnerabilities Access of Uninitialized Pointer, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Deadlock, Detection of Error Condition Without Action, Double Free, Expired Pointer Dereference, Heap-based Buffer Overflow, Improper Control of Resource Identifiers ('Resource Injection'), Improper Control of a Resource Through its Lifetime, Improper Handling of Length Parameter Inconsistency, Improper Handling of Missing Special Element, Improper Handling of Structural Elements, Improper Input Validation, Improper Locking, Improper Resource Locking, Improper Restriction of Operations within the Bounds of a Memory Buffer, Improper Update of Reference Count, Improper Validation of Array Index, Improper Validation of Consistency within Input, Improper Validation of Specified Index, Position, or Offset in Input, Improper Validation of Specified Quantity in Input, Improper Validation of Specified Type of Input, Incorrect Synchronization, Integer Overflow or Wraparound, Integer Underflow (Wrap or Wraparound), Loop with Unreachable Exit Condition ('Infinite Loop'), Missing Default Case in Multiple Condition Expression, Missing Initialization of Resource, Missing Lock Check, Missing Release of Memory after Effective Lifetime, Missing Release of Resource after Effective Lifetime, Multiple Locks of a Critical Resource, NULL Pointer Dereference, Operation on a Resource after Expiration or Release, Out-of-bounds Read, Out-of-bounds Write, Plaintext Storage of a Password, Release of Invalid Pointer or Reference, Return of Wrong Status Code, Signal Handler Race Condition, Time-of-check Time-of-use (TOCTOU) Race Condition, Unchecked Return Value, Use After Free, Use of Incorrect Operator, Use of Uninitialized Resource, Write-what-where Condition Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2023-52927 In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nf_ct_find_expectation Currently nf_conntrack_in() calling nf_ct_find_expectation() will remove the exp from the hash table. However, in some scenario, we expect the exp not to be removed when the created ct will not be confirmed, like in OVS and TC conntrack in the following patches. This patch allows exp not to be removed by setting IPS_CONFIRMED in the status of the tmpl. Read More 1 Affected Product SIMATIC S7-1500 TM MFP - GNU/Linux subsystem Product Status: known_affected Remediations Mitigation Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only. Mitigation Only build and run applications from trusted sources. None available Currently no fix is available Additional Metrics Relevant CWE: CWE-20 Improper Input Validation CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H View CVE Details CVE-2023-52927 CVE-2023-53292 CVE-2023-54271 CVE-2024-26982 CVE-2024-36922 CVE-2024-40945 CVE-2024-47809 CVE-2024-49998 CVE-2024-53166 CVE-2024-56647 CVE-2024-56657 CVE-2024-56719 CVE-2024-57977 CVE-2024-57979 CVE-2024-57980 CVE-2024-57981 CVE-2024-57986 CVE-2024-57993 CVE-2024-57996 CVE-2024-58002 CVE-2024-58005 CVE-2024-58009 CVE-2024-58013 CVE-2024-58014 CVE-2024-58017 CVE-2024-58020 CVE-2024-58058 CVE-2024-58061 CVE-2024-58063 CVE-2024-58068 CVE-2024-58071 CVE-2024-58072 CVE-2024-58077 CVE-2024-58079 CVE-2024-58083 CVE-2025-21682 CVE-2025-21700 CVE-2025-21702 CVE-2025-21703 CVE-2025-21704 CVE-2025-21705 CVE-2025-21706 CVE-2025-21707 CVE-2025-21708 CVE-2025-21716 CVE-2025-21719 CVE-2025-21724 CVE-2025-21725 CVE-2025-21726 CVE-2025-21727 CVE-2025-21728 CVE-2025-21731 CVE-2025-21735 CVE-2025-21738 CVE-2025-21744 CVE-2025-21745 CVE-2025-21753 CVE-2025-21756 CVE-2025-21758 CVE-2025-21760 CVE-2025-21761 CVE-2025-21762 CVE-2025-21763 CVE-2025-21764 CVE-2025-21765 CVE-2025-21766 CVE-2025-21767 CVE-2025-21776 CVE-2025-21779 CVE-2025-21787 CVE-2025-21790 CVE-2025-21791 CVE-2025-21795 CVE-2025-21796 CVE-2025-21806 CVE-2025-21814 CVE-2025-21830 CVE-2025-21832 CVE-2025-21835 CVE-2025-21838 CVE-2025-21844 CVE-2025-21846 CVE-2025-21858 CVE-2025-21859 CVE-2025-21862 CVE-2025-21863 CVE-2025-21864 CVE-2025-21865 CVE-2025-22105 CVE-2025-23131 CVE-2025-38105 CVE-2025-38162 CVE-2025-38192 CVE-2025-38250 CVE-2025-38584 CVE-2025-38704 CVE-2025-39748 CVE-2025-39863 CVE-2025-39997 CVE-2025-40135 CVE-2025-68206 CVE-2025-68239 CVE-2025-68265 CVE-2026-23066 CVE-2026-23100 CVE-2026-23113 CVE-2026-23141 CVE-2026-23154 CVE-2026-23157 CVE-2026-23204 CVE-2026-23231 CVE-2026-23245 CVE-2026-23253 CVE-2026-23255 CVE-2026-23270 CVE-2026-23271 CVE-2026-23272 CVE-2026-23273 CVE-2026-23274 CVE-2026-23277 CVE-2026-23278 CVE-2026-23279 CVE-2026-23281 CVE-2026-23290 CVE-2026-23291 CVE-2026-23292 CVE-2026-23296 CVE-2026-23300 CVE-2026-23302 CVE-2026-23303 CVE-2026-23304 CVE-2026-23310 CVE-2026-23312 CVE-2026-23315 CVE-2026-23317 CVE-2026-23318 CVE-2026-23319 CVE-2026-23321 CVE-2026-23336 CVE-2026-23339 CVE-2026-23340 CVE-2026-23343 CVE-2026-23351 CVE-2026-23352 CVE-2026-23356 CVE-2026-23357 CVE-2026-23359 CVE-2026-23364 CVE-2026-23365 CVE-2026-23367 CVE-2026-23368 CVE-2026-23370 CVE-2026-23372 CVE-2026-23378 CVE-2026-23379 CVE-2026-23381 CVE-2026-23382 CVE-2026-23388 CVE-2026-23389 CVE-2026-23391 CVE-2026-23392 CVE-2026-23395 CVE-2026-23396 CVE-2026-23397 CVE-2026-23398 CVE-2026-23399 CVE-2026-23442 CVE-2026-23444 CVE-2026-31407 CVE-2026-31449 CVE-2026-31451 CVE-2026-31488 CVE-2026-31500 CVE-2026-31532 CVE-2026-31580 CVE-2026-31583 CVE-2026-31586 CVE-2026-31611 CVE-2026-31612 CVE-2026-31613 CVE-2026-31617 CVE-2026-31622 CVE-2026-31624 CVE-2026-31625 CVE-2026-31629 CVE-2026-31630 CVE-2026-31637 CVE-2026-31642 CVE-2026-31673 CVE-2026-31676 CVE-2026-31681 CVE-2026-31685 CVE-2026-31694 CVE-2026-31696 CVE-2026-31697 CVE-2026-31698 CVE-2026-31699 CVE-2026-31700 CVE-2026-31704 CVE-2026-31705 CVE-2026-31708 CVE-2026-31709 CVE-2026-31711 CVE-2026-31712 CVE-2026-43052 CVE-2026-43071 CVE-2026-43074 CVE-2026-43080 CVE-2026-43085 CVE-2026-43089 CVE-2026-43093 CVE-2026-43094 CVE-2026-43099 CVE-2026-43110 CVE-2026-43111 CVE-2026-43112 CVE-2026-43114 CVE-2026-43116 CVE-2026-43117 CVE-2026-43303 CVE-2026-43350 CVE-2026-43421 CVE-2026-43492 CVE-2026-43493 CVE-2026-43496 CVE-2026-43499 CVE-2026-43502 CVE-2026-43503 CVE-2026-45834 CVE-2026-45835 CVE-2026-45836 CVE-2026-45838 CVE-2026-45839 CVE-2026-45840 CVE-2026-45841 CVE-2026-45842 CVE-2026-45843 CVE-2026-45844 CVE-2026-45850 CVE-2026-45991 CVE-2026-45997 CVE-2026-46003 CVE-2026-46015 CVE-2026-46018 CVE-2026-46021 CVE-2026-46022 CVE-2026-46023 CVE-2026-46026 CVE-2026-46033 CVE-2026-46037 CVE-2026-46038 CVE-2026-46040 CVE-2026-46044 CVE-2026-46046 CVE-2026-46047 CVE-2026-46050 CVE-2026-46051 CVE-2026-46056 CVE-2026-46064 CVE-2026-46065 CVE-2026-46069 CVE-2026-46070 CVE-2026-46083 CVE-2026-46086 CVE-2026-46088 CVE-2026-46092 CVE-2026-46099 CVE-2026-46101 CVE-2026-46102 CVE-2026-46107 CVE-2026-46110 CVE-2026-46113 CVE-2026-46116 CVE-2026-46120 CVE-2026-46122 CVE-2026-46124 CVE-2026-46125 CVE-2026-46128 CVE-2026-46136 CVE-2026-46137 CVE-2026-46146 CVE-2026-46149 CVE-2026-46150 CVE-2026-46151 CVE-2026-46159 CVE-2026-46161 CVE-2026-46163 CVE-2026-46165 CVE-2026-46167 CVE-2026-46168 CVE-2026-46172 CVE-2026-46173 CVE-2026-46177 CVE-2026-46180 CVE-2026-46185 CVE-2026-46187 CVE-2026-46190 CVE-2026-46191 CVE-2026-46193 CVE-2026-46195 CVE-2026-46196 CVE-2026-46209 CVE-2026-46214 CVE-2026-46227 CVE-2026-46234 CVE-2026-46243 CVE-2026-46275 CVE-2026-46294 CVE-2026-46303 CVE-2026-46304 CVE-2026-46306 CVE-2026-46307 CVE-2026-46320 CVE-2026-46321 CVE-2026-46322 CVE-2026-46323 CVE-2026-46331 CVE-2026-52909 CVE-2026-52910 CVE-2026-52917 CVE-2026-52918 CVE-2026-52923 CVE-2026-52928 CVE-2026-52929 CVE-2026-52930 CVE-2026-52942 CVE-2026-52943 CVE-2026-52946 CVE-2026-52947 CVE-2026-52948 CVE-2026-53080 CVE-2026-53131 CVE-2026-53146 CVE-2026-53147 CVE-2026-53148 CVE-2026-53149 CVE-2026-53150 CVE-2026-53167 CVE-2026-53168 CVE-2026-53177 CVE-2026-53181 CVE-2026-53183 CVE-2026-53184 CVE-2026-53192 CVE-2026-53198 CVE-2026-53208 CVE-2026-53212 CVE-2026-53218 CVE-2026-53219 CVE-2026-53221 CVE-2026-53225 CVE-2026-53227 CVE-2026-53228 CVE-2026-53236 CVE-2026-53239 CVE-2026-53242 CVE-2026-53245 CVE-2026-53249 CVE-2026-53253 CVE-2026-53254 CVE-2026-53255 CVE-2026-53256 CVE-2026-53263 CVE-2026-53264 CVE-2026-53265 CVE-2026-53268 CVE-2026-53269 CVE-2026-53275 CVE-2026-53325 CVE-2026-53337 CVE-2026-53349 CVE-2026-53350 CVE-2026-53352 CVE-2026-53356 CVE-2026-53358 CVE-2026-53362 CVE-2026-64560 Acknowledgments Siemens ProductCERT reported these vulnerabilities to CISA. General Recommendations As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet . Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-784472 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-13 Date Revision Summary 2026-10-13 1 Publication Date 2026-10-22 2 Initial CISA Republication of Siemens ProductCERT SSA-784472 advisory Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-22 CISA Advisory

Siemens SIMATIC S7 Webserver API

View CSAF Summary .NET Client Library for SIMATIC S7 Webserver API contains multiple vulnerabilities that could allow an attacker to obtain sensitive information or write arbitrary files outside the intended download directory. Siemens has released a new version for .NET Client Library for SIMATIC S7 Webserver API and recommends to update to the latest version. The following versions of Siemens SIMATIC S7 Webserver API are affected: .NET Client Library for SIMATIC S7 Webserver API vers:intdot/ CVSS Vendor Equipment v3 7.5 Siemens .NET Client Library for SIMATIC S7 Webserver API 2 Vulnerabilities Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Generation of Error Message Containing Sensitive Information Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2026-85114 Affected applications do not properly validate filenames received from remote servers during ticket downloads. This could allow an attacker who can manipulate the ticket response to write arbitrary files outside the intended download directory and, when overwriting is enabled, replace existing files accessible to the application. Read More 1 Affected Product .NET Client Library for SIMATIC S7 Webserver API Product Status: known_affected Remediations Vendor fix Update to V3.3.61 or later version Additional Metrics Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N View CVE Details CVE-2026-85115 Affected applications do not properly redact PLC restore passwords from HTTP error exception messages. This could allow an attacker with access to logs or other diagnostic output to obtain the plaintext restore password and potentially perform unauthorized operations on the PLC. Read More 2 Affected Products .NET Client Library for SIMATIC S7 Webserver API Product Status: known_affected Remediations .NET Client Library for SIMATIC S7 Webserver API Product Status: known_affected Remediations Vendor fix Update to V3.3.62 or later version Additional Metrics Relevant CWE: CWE-209 Generation of Error Message Containing Sensitive Information CVSS Version Base Score Base Severity Vector String 3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N View CVE Details Acknowledgments Siemens ProductCERT reported these vulnerabilities to CISA. General Recommendations As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet . Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-390352 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-13 Date Revision Summary 2026-10-13 1 Publication Date 2026-10-22 2 Initial CISA Republication of Siemens ProductCERT SSA-390352 advisory Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-22 CISA Advisory

Siemens WinCC

View CSAF Summary Multiple SIMATIC WinCC versions are affected by a database privilege escalation vulnerability that could allow an authenticated user with access to the database to execute commands on the underlying host system. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends mitigations for products where fixes are not or not yet available. The following versions of Siemens WinCC are affected: SIMATIC WinCC V7.5 vers:all/* (CVE-2026-59241) SIMATIC WinCC V8.0 vers:intdot/ SIMATIC WinCC V8.1 vers:intdot/ CVSS Vendor Equipment v3 8.8 Siemens SIMATIC WinCC V7.5 1 Vulnerability Incorrect Privilege Assignment Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities CVE-2026-59241 The affected application does not sufficiently restrict the permissions assigned to a database role. This could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system. Read More 3 Affected Products SIMATIC WinCC V7.5 Product Status: known_affected Remediations None available Currently no fix is available SIMATIC WinCC V8.0 Product Status: known_affected Remediations Vendor fix Update to V8.0 Update 11 or later version SIMATIC WinCC V8.1 Product Status: known_affected Remediations Vendor fix Update to V8.1 Update 7 or later version Additional Metrics Relevant CWE: CWE-266 Incorrect Privilege Assignment CVSS Version Base Score Base Severity Vector String 3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H View CVE Details Acknowledgments Siemens ProductCERT reported this vulnerability to CISA. General Recommendations As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet . Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-550198 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-13 Date Revision Summary 2026-10-13 1 Publication Date 2026-10-22 2 Initial CISA Republication of Siemens ProductCERT SSA-550198 advisory Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-22 CISA Advisory

Kiloview E3 NDI Encoder

View CSAF Summary Successful exploitation of this these vulnerabilities could allow an attacker to fully compromise the device. The following versions of Kiloview E3 NDI Encoder are affected: E3 Firmware CVSS Vendor Equipment v3 9.9 Kiloview E3 Firmware 6 Vulnerabilities Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Missing Authentication for Critical Function, Insufficient Session Expiration, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), NULL Pointer Dereference, Use of Hard-coded Credentials Background Critical Infrastructure Sectors: Communications, Information Technology Countries/Areas Deployed: Worldwide Company Headquarters Location: China Vulnerabilities Expand All + CVE-2026-109122 The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots. Successful exploitation could result in full device compromise, including exposure of stored credentials and cryptographic material. Read More 1 Affected Product Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Additional Metrics Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CVSS Version Base Score Base Severity Vector String 3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H 4.0 9.4 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H View CVE Details CVE-2026-111100 The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote, unauthenticated party can retrieve detailed device identifiers along with a list of configured user accounts and their privilege levels. This aids attackers in fingerprinting vulnerable devices and preparing targeted credential attacks. Read More 2 Affected Products Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Additional Metrics Relevant CWE: CWE-306 Missing Authentication for Critical Function CVSS Version Base Score Base Severity Vector String 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.0 6.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N View CVE Details CVE-2026-96616 Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extended period. Read More 3 Affected Products Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Additional Metrics Relevant CWE: CWE-613 Insufficient Session Expiration CVSS Version Base Score Base Severity Vector String 3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N 4.0 8.3 HIGH CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N View CVE Details CVE-2026-105265 A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to cause /etc/localtime to point to a file outside the intended zoneinfo directory Read More 4 Affected Products Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Additional Metrics Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVSS Version Base Score Base Severity Vector String 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N 4.0 6 MEDIUM CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N View CVE Details CVE-2026-110491 The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automatically after a period. This can be triggered repeatedly by any unauthenticated party with network access to the device. Read More 5 Affected Products Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Additional Metrics Relevant CWE: CWE-476 NULL Pointer Dereference CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 4.0 6.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N View CVE Details CVE-2026-107861 The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise. Read More 6 Affected Products Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Additional Metrics Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CVSS Version Base Score Base Severity Vector String 3.1 9.9 CRITICAL CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 4.0 9.4 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H View CVE Details CVE-2026-110243 The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated web user with permission to configure network settings can exploit this to execute arbitrary operating system commands as root. Read More 7 Affected Products Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Additional Metrics Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CVSS Version Base Score Base Severity Vector String 3.1 9.9 CRITICAL CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 4.0 9.4 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H View CVE Details CVE-2026-92450 The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and forge arbitrary session tokens, including administrative tokens, without valid credentials, enabling unauthenticated access to privileged device functions. Read More 8 Affected Products Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Additional Metrics Relevant CWE: CWE-798 Use of Hard-coded Credentials CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N View CVE Details CVE-2026-110825 The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the device hostname, redirect DNS resolution, or modify the configured time source, enabling follow on attacks such as traffic interception or certificate validation bypass. Read More 9 Affected Products Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Additional Metrics Relevant CWE: CWE-306 Missing Authentication for Critical Function CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N 4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N View CVE Details Acknowledgments Juan Alonso reported these vulnerabilities to CISA. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet . Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. Revision History Initial Release Date: 2026-10-22 Date Revision Summary 2026-10-22 1 Initial Publication Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Critical CISA Advisory

2026-10-21 CISA Advisory

Critical Vulnerabilities in PHP Require Immediate Patching

Update October 26, 2026: CISA has updated this Alert to reflect the addition of CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 26, 2026. Update October 23, 2026 : CISA has updated this Alert to: (1) provide a SIGMA detection rule to help identify potentially suspicious activity; (2) incorporate partner resources; and (3) reinforce existing mitigation guidance. Purpose CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619 . These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP. The vulnerabilities affect all PHP installations serving web requests, including Apache with mod_php ( Note : PHP considers this highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. CISA added CVE-2026-109618 and CVE-2026-109619 to its KEV Catalog on Oct. 26, 2026. Actions to take CISA urges organizations to take the following actions: Identify and inventory systems running any version of PHP across your organization. PHP is often a component of other software and prevalence may not be directly observable. Apply the patch immediately, prioritizing internet-facing systems. Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated. A web application firewall may provide some protection until systems are updated or patched. Review the official PHP security advisory for guidance on patching. Monitor for suspicious activity, including PHP worker processes launching shells or downloading tools. Resources CISA urges network defenders to review the following advisories and resources and apply necessary updates: PHP’s Guidance PHP’s Security Advisory: Critical Remote Code Execution Vulnerabilities, Update Now PHP’s Blog: Today's PHP Security Release, and How We're Strengthening PHP Security Partner Guidance United States National Security Agency’s (NSA) Advisory: Critical Patches Recommended for PHP Vulnerabilities United Kingdom National Cyber Security Centre’s (NCSC-UK) Alert: Critical security issue affecting PHP Australian Signals Directorate’s Australian Cyber Security Centre’s (ASD’s ACSC) Alert: Critical vulnerabilities in PHP National Cyber Security Centre’s (NCSC-NL) GitHub repository: php2shell New Zealand National Cyber Security Centre’s (NCSC-NZ) NCSC encourages immediate patching against PHP vulnerability Canadian Centre for Cyber Security’s (Cyber Centre) Alert: Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 Organizations may also review CISA’s SIGMA detection rule to help identify potentially suspicious activity in relevant log sources ( Note : CISA may update this resource as more information becomes available): CISA’s SIGMA Rules GitHub Repository Disclaimer The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-20 CISA Advisory

Hitachi Energy RTU500 Product

View CSAF Summary Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. These vulnerabilities if exploited can have impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation. The following versions of Hitachi Energy RTU500 Product are affected: RTU500 series CMU Firmware vers:RTU500_series_CMU_Firmware/>=13.5.1| =13.6.1| =13.7.1| =13.8.1| =12.7.1| CVSS Vendor Equipment v3 8.8 Hitachi Energy RTU500 series CMU Firmware 7 Vulnerabilities NULL Pointer Dereference, Access of Resource Using Incompatible Type ('Type Confusion'), Use After Free, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials, Authentication Bypass by Capture-replay, Authentication Bypass by Primary Weakness Background Critical Infrastructure Sectors: Energy Countries/Areas Deployed: Worldwide Company Headquarters Location: Switzerland Vulnerabilities Expand All + CVE-2026-17539 RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced message queue. This can cause a BCI_IEC104 fatal write error, resulting in connection interruption and restart, and ultimately a denial of service for bidirectional IEC 60870-5-104 communication. Read More 5 Affected Products RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 12.7.8 OR Vendor fix Upgrade to CMU Firmware version 13.9.1 Additional Metrics Relevant CWE: CWE-476 NULL Pointer Dereference CVSS Version Base Score Base Severity Vector String 3.1 5.9 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H View CVE Details CVE-2026-28388 A vulnerability exists in OpenSSL library component of RTU500 that is used for secure HTTPS access, authenticating and establishing encrypted communications with other devices. When processing a malformed delta CRL with a Delta CRL Indicator but no required CRL Number extension, OpenSSL may dereference a NULL pointer, causing a Denial of Service during X.509 certificate verification. Exploitation requires delta CRL processing to be enabled, a relevant freshest CRL condition to be present, and an attacker-supplied malformed CRL. The issue is limited to Denial of Service and cannot lead to code execution or memory disclosure. Read More 10 Affected Products RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 12.7.8 OR Vendor fix Upgrade to CMU Firmware version 13.9.1 RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 12.7.8 OR Vendor fix Upgrade to CMU Firmware version 13.9.1 Additional Metrics Relevant CWE: CWE-476 NULL Pointer Dereference CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H View CVE Details CVE-2026-6732 The XML-based services used in RTU500 has a vulnerability while processing a specially crafted XSD-validated XML document may trigger a type confusion error in libxml2. An attacker could exploit this condition to cause a denial of service. Read More 14 Affected Products RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* Additional Metrics Relevant CWE: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion') CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H View CVE Details CVE-2026-6653 The XML-based services used in RTU500 has a vulnerability, where a use-after-free vulnerability in the xmlParseInternalSubset function of libxml2 may be triggered by processing specially crafted XML input. Improper handling of entity resolution can allow a remote attacker to cause a denial of service. Read More 19 Affected Products RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 12.7.8 OR Vendor fix Upgrade to CMU Firmware version 13.9.1 RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 12.7.8 OR Vendor fix Upgrade to CMU Firmware version 13.9.1 RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 12.7.8 OR Vendor fix Upgrade to CMU Firmware version 13.9.1 Additional Metrics Relevant CWE: CWE-416 Use After Free CVSS Version Base Score Base Severity Vector String 3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H View CVE Details CVE-2026-6276 A vulnerability exists in the web-based management and services functions of RTU500 using libcurl library, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same easy handle but without the custom `Host:` header set, the second request would use leaked stale information and pass on cookies meant for the first host in the second request. Read More 23 Affected Products RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* Additional Metrics Relevant CWE: CWE-319 Cleartext Transmission of Sensitive Information CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H View CVE Details CVE-2026-9079 A vulnerability exists in the web-based management and services functions of RTU500 using libcurl library. libcurl may fail to clear proxy authentication credentials when instructed to do so. As a result, stale credentials can be reused by subsequent transfers that should not access them, potentially exposing sensitive proxy authentication information. Read More 27 Affected Products RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* Additional Metrics Relevant CWE: CWE-522 Insufficiently Protected Credentials CVSS Version Base Score Base Severity Vector String 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N View CVE Details CVE-2026-11856 A vulnerability exists in the web-based management and services functions of RTU500 using libcurl library. When the same libcurl handle is reused after a transfer to one HTTP origin using Digest authentication, libcurl may incorrectly send the Authorization header intended for the first origin to a second origin. This can disclose authentication information to an unintended host. Read More 31 Affected Products RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* Additional Metrics Relevant CWE: CWE-294 Authentication Bypass by Capture-replay CVSS Version Base Score Base Severity Vector String 3.1 8.1 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H View CVE Details CVE-2026-8927 A vulnerability exists in the web-based management and services functions of RTU500 using libcurl library. When reusing a libcurl handle for sequential transfers with environment-variable proxy configuration, libcurl may fail to clear proxy authentication state between requests. This can leak the Proxy-Authorization header intended for one proxy to another proxy. Read More 35 Affected Products RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* Additional Metrics Relevant CWE: CWE-294 Authentication Bypass by Capture-replay CVSS Version Base Score Base Severity Vector String 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N View CVE Details CVE-2026-8932 A vulnerability exists in the web-based management and services functions of RTU500 using libcurl library. libcurl may reuse an existing connection even after mTLS-related configuration options, especially client certificate or private key settings, have changed. This can bypass the intended authentication configuration and allow use of a connection that should no longer be reused. Read More 39 Affected Products RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* Additional Metrics Relevant CWE: CWE-305 Authentication Bypass by Primary Weakness CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N View CVE Details Acknowledgments Hitachi Energy Internal Team reported these vulnerabilities to CISA. Notice The information in this document is subject to change without notice and should not be construed as a commitment by Hitachi Energy. Hitachi Energy provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall Hitachi Energy or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if Hitachi Energy or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from Hitachi Energy and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners. Support For additional information and support please contact your product provider or Hitachi Energy service organization. For contact information, see https://www.hitachienergy.com/contact-us/ for Hitachi Energy contact-centers. General Mitigation Factors Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system. Proper password policies and processes should be followed. Additional information on Industrial Control Systems Cybersecurity Best Practices can be found in the Hitachi Energy “Industrial Control Systems Cybersecurity Best Practices” Cybersecurity Notification. [1] SSVC SSVCv2/E:N/A:N/2026-09-28T14:29:30Z/ Recommended Practices CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability. Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Hitachi Energy PSIRT 8DBD000259 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Hitachi Energy PSIRT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-09-01 Date Revision Summary 2026-09-01 1 Initial public release 2026-09-29 2 Updated fixed version 12.7.8 2026-10-20 3 Initial CISA Republication of Hitachi Energy PSIRT 8DBD000259 advisory Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Critical CISA Advisory

2026-10-20 CISA Advisory

CISA Adds Six Known Exploited Vulnerabilities to Catalog

CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities . CISA will continue to add vulnerabilities to the catalog that meet the specified criteria . Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form . Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-20 CISA Advisory

Hitachi Energy MicroSCADA X SYS600 Product

View CSAF Summary Hitachi Energy is aware of multiple vulnerabilities that affect MicroSCADA X SYS600 product versions listed in this document. These vulnerabilities can be exploited to carry out various attacks on the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation. The following versions of Hitachi Energy MicroSCADA X SYS600 Product are affected: MicroSCADA X SYS600 vers:MicroSCADA_X_SYS600/ CVSS Vendor Equipment v3 7.8 Hitachi Energy MicroSCADA X SYS600 2 Vulnerabilities Improper Neutralization of Formula Elements in a CSV File, Incorrect Implementation of Authentication Algorithm Background Critical Infrastructure Sectors: Energy Countries/Areas Deployed: Worldwide Company Headquarters Location: Switzerland Vulnerabilities Expand All + CVE-2026-9852 A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue attackers would need a way to create arbitrary log messages. This could be achieved through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker. This vulnerability affects all Windows users regardless of their privilege level who can run the Notify service and export the log. Read More 1 Affected Product MicroSCADA X SYS600 versions 10.7 and prior Product Status: known_affected Remediations Vendor fix Update to version 10.8 Mitigation Follow general mitigation factors/workarounds Additional Metrics Relevant CWE: CWE-1236 Improper Neutralization of Formula Elements in a CSV File CVSS Version Base Score Base Severity Vector String 3.1 5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N 4.0 4.6 MEDIUM CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N View CVE Details CVE-2026-9853 A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users should be permitted to view and modify application objects. Read More 3 Affected Products MicroSCADA X SYS600 versions 10.7 and prior Product Status: known_affected Remediations Vendor fix Update to version 10.8 and Follow mitigation strategy. Refer to MicroSCADA X SYS00 10.8 Installation and Administration Manual, Section 2.1.7.5 (Mitigation strategy is available for versions 10.3 onwards). Also refer to MicroSCADA X 10.8 Cybersecurity Deployment Guide Mitigation Follow mitigation strategy. Refer to MicroSCADA X SYS00 10.8 Installation and Administration Manual, Section 2.1.7.5 (Mitigation strategy is available for versions 10.3 onwards). Also refer to MicroSCADA X 10.8 Cybersecurity Deployment Guide Mitigation Follow general mitigation factors/workarounds MicroSCADA X SYS600 versions 10.7 and prior Product Status: known_affected Remediations Vendor fix Update to version 10.8 and Follow mitigation strategy. Refer to MicroSCADA X SYS00 10.8 Installation and Administration Manual, Section 2.1.7.5 (Mitigation strategy is available for versions 10.3 onwards). Also refer to MicroSCADA X 10.8 Cybersecurity Deployment Guide Mitigation Follow mitigation strategy. Refer to MicroSCADA X SYS00 10.8 Installation and Administration Manual, Section 2.1.7.5 (Mitigation strategy is available for versions 10.3 onwards). Also refer to MicroSCADA X 10.8 Cybersecurity Deployment Guide Mitigation Follow general mitigation factors/workarounds MicroSCADA X SYS600 version 10.8 Product Status: known_affected Remediations Mitigation Follow mitigation strategy. Refer to MicroSCADA X SYS00 10.8 Installation and Administration Manual, Section 2.1.7.5 (Mitigation strategy is available for versions 10.3 onwards). Also refer to MicroSCADA X 10.8 Cybersecurity Deployment Guide Mitigation Follow general mitigation factors/workarounds Additional Metrics Relevant CWE: CWE-303 Incorrect Implementation of Authentication Algorithm CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 4.0 8.5 HIGH CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N View CVE Details CVE-2026-9854 A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine. Read More 4 Affected Products MicroSCADA X SYS600 versions 10.7 and prior Product Status: known_affected Remediations Vendor fix Update to version 10.8 Mitigation Follow general mitigation factors/workarounds MicroSCADA X SYS600 versions 10.7 and prior Product Status: known_affected Remediations Vendor fix Update to version 10.8 Mitigation Follow general mitigation factors/workarounds MicroSCADA X SYS600 version 10.8 Product Status: known_affected Remediations MicroSCADA X SYS600 versions 10.7 and prior Product Status: known_affected Remediations Vendor fix Update to version 10.8 Mitigation Follow general mitigation factors/workarounds Additional Metrics Relevant CWE: CWE-303 Incorrect Implementation of Authentication Algorithm CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 4.0 8.5 HIGH CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N View CVE Details Acknowledgments Zachary Andrew Wagner, Steven Nicolais, and Timotius Oetnung of the Sandia National Laboratories (CyTRICS program) reported these vulnerabilities to CISA. Notice The information in this document is subject to change without notice and should not be construed as a commitment by Hitachi Energy. Hitachi Energy provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall Hitachi Energy or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if Hitachi Energy or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from Hitachi Energy and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners. Support For additional information and support please contact your product provider or Hitachi Energy service organization. For contact information, see https://www.hitachienergy.com/contact-us/ for Hitachi Energy contact-centers. General Mitigation Factors Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system. Proper password policies and processes should be followed. Additional information on Industrial Control Systems Cybersecurity Best Practices can be found in the Hitachi Energy’s “Industrial Control Systems Cybersecurity Best Practices” Cybersecurity Notification. [1] SSVC SSVCv2/E:N/A:N/2026-09-28T14:40:32Z/ Recommended Practices CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability. Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Hitachi Energy PSIRT 8DBD000249 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Hitachi Energy PSIRT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-09-01 Date Revision Summary 2026-09-01 1 Initial public release 2026-09-29 2 Added researcher’s name under Acknowledgement 2026-10-20 3 Initial CISA Republication of Hitachi Energy PSIRT 8DBD000249 advisory Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-20 CISA Advisory

WAGO OS Linux

View CSAF Summary Two vulnerabilities in the Web-Based Management (WBM) interface of WAGO CC100, PFC100 G2, PFC200 G2, TP600, Edge Controller and WP400 devices allow an authenticated low-privileged user to bypass intended privilege boundaries. The issues affect both the routing configuration functionality and the authorization model for PROFIBUS configuration management. The following versions of WAGO OS Linux are affected: WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| CVSS Vendor Equipment v3 8.8 WAGO WAGO Firmware (vers:semver/>=1.0.0| 2 Vulnerabilities Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Missing Authorization Background Critical Infrastructure Sectors: Chemical, Critical Manufacturing, Commercial Facilities, Energy, Transportation Systems, Water and Wastewater Systems Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2026-80466 A vulnerability in the Web-Based Management (WBM) routing configuration allows a low-privileged remote attacker to inject shell commands into routing parameters. Due to insufficient input validation, these values are stored in a configuration file and later processed by a privileged root helper script. Read More 22 Affected Products WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Additional Metrics Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CVSS Version Base Score Base Severity Vector String 3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N View CVE Details CVE-2026-88850 The Web-Based Management (WBM) authorization model does not properly enforce permissions for all PROFIBUS configuration operations. A low-privileged remote attacker can abuse an exposed configuration function to modify root-owned PROFIBUS parameters, including device addressing and SSA settings. This allows unauthorized changes to fieldbus-related configuration and violates the intended privilege boundaries within the management interface. Read More 44 Affected Products WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Additional Metrics Relevant CWE: CWE-862 Missing Authorization CVSS Version Base Score Base Severity Vector String 3.1 8.1 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H 4.0 7.2 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N View CVE Details Acknowledgments CERT@VDE coordinated with WAGO. Ievgen Bondarenko reported these vulnerabilities to CISA. Impact Successful exploitation of CVE-2026-80466 may allow a low-privileged attacker to execute commands with root privileges. CVE-2026-88850 allows a low-privileged attacker to perform unauthorized modifications of protected PROFIBUS configuration parameters. Remediation Update to Firmware version 4.10.0 (FW32) or higher. For the latest custom Firmware please contact the WAGO support. Recommended Practices CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability. Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of WAGO GmbH & Co. KG VDE-2026-096 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact WAGO GmbH & Co. KG directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-20 Date Revision Summary 2026-10-20 1 Release version. 2026-10-20 2 Initial CISA Republication of WAGO GmbH & Co. KG VDE-2026-096 advisory Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Critical CISA Advisory

2026-10-20 CISA Advisory

#StopRansomware: SafePay Ransomware

Advisory at a Glance Title #StopRansomware: SafePay Ransomware Original Publication October 20, 2026 Executive Summary This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay actors typically gain access to networks by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using phishing tactics. Once inside the network, SafePay actors establish control by creating new accounts or taking over existing ones. They then use legitimate system tools to move through the network, identify valuable files, and disable security protections to avoid detection. Next, they encrypt the victim’s files, making them inaccessible, and leave a ransom note demanding payment in cryptocurrency. This advisory urges organizations to follow recommended security measures to reduce the risk and impact of SafePay ransomware attacks. Affected Products CVE-2020-3259 [ Common Weakness Enumeration (CWE)-200: Exposure of Sensitive Information to an Unauthorized Actor ] CVE-2023-20269 [ CWE-288: Authentication Bypass Using an Alternate Path or Channel ] CVE-2023-27532 [ CWE-306: Missing Authentication for Critical Function ] CVE-2024-40711 [ CWE-502: Deserialization of Untrusted Data ] CVE-2024-40766 [ CWE-284: Improper Access Control ] Key Actions Regularly patch and update systems, especially firewalls, and other edge devices. Implement Zero Trust Principle. Restrict administrative tools and privileges to necessary users only. Strengthen account security by implementing identity, credential, and access management (ICAM) policies and multifactor authentication (MFA). Indicators of Compromise For a downloadable copy of indicators of compromise, see: AA26-293A STIX XML (40 KB) AA26-293A STIX JSON (38 KB) Intended Audience Organizations: Government; Federal Civilian Executive Branch (FCEB); State, Local, Tribal, and Territorial (SLTT); Critical Infrastructure Roles: Defensive cybersecurity analysts , vulnerability analysts , security systems managers , and operational technology (OT) owners and operators Introduction Note: This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources. The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), United States Secret Service (USSS), Germany’s Landeskriminalamt Rheinland-Pfalz, the United Kingdom’s National Crime Agency, and the United Kingdom’s North West Regional Organised Crime Unit—hereafter referred to as the authoring agencies—are releasing this joint advisory to disseminate known SafePay ransomware TTPs and IOCs identified through FBI, USSS, and Landeskriminalamt Rheinland-Pfalz investigations as recently as August 2026. Since August 2024, SafePay ransomware group’s operations have affected a wide range of businesses and critical infrastructure in North America, South America, Europe, and Australia. SafePay ransomware was among the most active ransomware groups in 2026. The SafePay threat actors have impacted at least 600 separate victims from multiple critical infrastructure sectors. The authoring agencies encourage organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of SafePay ransomware incidents. Download the PDF version of this report: #StopRansomware: SafePay Ransomware (PDF, 1.06 MB ) For a downloadable copy of IOCs, see: AA26-293A-STIX XML (XML, 40.23 KB ) AA26-293A-STIX JSON (JSON, 37.49 KB ) Technical Details Note: This advisory uses the MITRE ATT&CK ® Matrix for Enterprise framework, version 20. See MITRE ATT&CK Tactics and Techniques section of this advisory for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques. Initial Access The FBI, USSS, and cybersecurity researchers observed SafePay threat actors obtaining initial access [ TA0001 ] to organizations through various means, including credential exposure, implementing brute force password attacks [ T1110 ], and exploiting virtual private network (VPN) access. SafePay threat actors use the IP addresses of the VPN provider “Mullvad” to attain initial access—specifically, SafePay threat actors use phished account profiles to access victim networks to exploit the following known Common Vulnerabilities and Exposures (CVEs) for edge device products: CVE-2020-3259 [ Common Weakness Enumeration (CWE)-200: Exposure of Sensitive Information to an Unauthorized Actor ] CVE-2023-20269 [ CWE-288: Authentication Bypass Using an Alternate Path or Channel ] Additionally, the authoring agencies observed SafePay threat actors exploiting the following vulnerabilities across internet-exposed systems [ T1190 ] for initial access through automated scripts: CVE-2023-27532 [ CWE-306: Missing Authentication for Critical Function ] CVE-2024-40711 [ CWE-502: Deserialization of Untrusted Data ] CVE-2024-40766 [ CWE-284: Improper Access Control ] Execution, Persistence, Stealth, and Defense Impairment After SafePay threat actors gain access to a victim network, they establish persistence by gaining administrative privileges on existing accounts [ T1098 ], or on newly created accounts [ T1136 ], using built-in administrative tools consistent with living off the land (LOTL) techniques. Once SafePay threat actors establish a foothold in a victim’s network, they use LOTL binaries (LOLBins) [ T1218 ], such as PsExec [ T1021.002 ] and Windows Remote Management (WinRM) [ T1021.006 ], to execute commands on remote systems. In several instances, SafePay threat actors used ShareFinder.ps1 —a PowerShell script function used for enumerating network file shares in Windows Active Directory environments—to identify valuable assets for exfiltration [ T1059.001 , T1059.003 ]. Additionally, SafePay threat actors used SharpShares.exe , a tool used to identify and enumerate network file shares. As SafePay threat actors prepare for lateral movement, they commonly disable security software [ T1685 ] to avoid detection. In some cases, the threat actors changed the passwords of system users, making valid logins impossible. SafePay threat actors have also been observed using software packing or virtual machine software protection to conceal their code [ T1027.002 ]. Privilege Escalation The authoring agencies observed SafePay threat actors using a User Account Control (UAC) Bypass Privilege Escalation technique [ T1548.002 ] that creates an elevated process through a specified component object model, enabling the execution of malicious commands or binaries [ T1059 ]. SafePay threat actors have also been observed using token impersonation methods [ T1134.001 ]. Lateral Movement To pivot laterally through a network and identify files for exfiltration [ TA0010 ] and encryption, SafePay threat actors use legitimate tools like PsExec, WinRM, and Remote Management and Monitoring [ T1569.002 ] software. They also employ Remote Desktop Protocol (RDP) [ T1021.001 , T1133 ] to expand their presence within the compromised network [ T1021 ]. As SafePay threat actors move laterally through a network, they look for credentials to gain admin access and will create accounts, if needed. Collection, Exfiltration, and Impact SafePay threat actors use legitimate tools, such as FileZilla, 7-Zip, RClone, and WinRAR to compress files and collect data [ T1560.001 ], and WinSCP and RClone to facilitate the exfiltration of data [ T1048 ] from the compromised network to actor-controlled accounts. In some instances, SafePay threat actors use OneDrive to exfiltrate data [ T1567 ]. In other instances, the SafePay threat actors installed legitimate remote desktop tools like AnyDesk or TeamViewer on the victim’s systems. SafePay threat actors use these tools to transfer ransomware and other software onto a victim’s system. Additionally, SafePay threat actors halt the Volume Shadow Copy Service and reset Network Attached Storage containing victim backup data to initial factory settings to inhibit system recovery attempts [ T1490 ]. Following exfiltration, SafePay threat actors encrypt files [ T1486 ] using a sophisticated hybrid encryption scheme to lock data. This involves combining a ChaCha20 stream cipher with an RSA public-key cryptosystem for a fast and secure key exchange. This multilayered approach customizes encryption methods based on file type and size and enables full or partial encryption. Data encrypted with the SafePay ransomware variant (appended with .SafePay ) cannot be recovered without the decryption key. SafePay threat actors hold the encrypted data for ransom and typically demand a subset of company revenue in cryptocurrency in exchange for decryption software. SafePay threat actors leave a ransom note on the victim’s system, typically on the desktop or root directory, advising them that SafePay locked their system and to reach out over a chat portal at a TOR .onion website link with a victim ID as the login. To put pressure on the victim, a representative makes phone calls on behalf of the ransomware group. If the victim does not pay, SafePay posts the exfiltrated data to their SafePay leak website, which is linked in the ransom note. Following encryption, SafePay may delete itself from the victim’s filesystem [ T1070.004 ]. Leveraged Tools Table 1 lists publicly available tools and applications used by SafePay threat actors, including legitimate tools repurposed for their operations. Note: These tools and applications should not be attributed as malicious without analytical evidence to support threat actor use and/or control. Table 1. Tools Leveraged by SafePay Threat Actors Tool Name Description 7-Zip An open source software that enables users to compress various file formats. SafePay threat actors maliciously use 7-Zip for data packaging and movement. FileZilla An open source client that enables users to transfer files between servers. SafePay threat actors use FileZilla maliciously for data exfiltration. Mimikatz A credential dumper that enables users to view and save authentication credentials, such as Kerberos tickets [ T1550.002 ]. SafePay threat actors use Mimikatz for password exfiltration. PowerShell A cross-platform task automation solution used for various malicious activities, including command execution. It is composed of a command-line shell, a scripting language, and a configuration management framework—which runs on Windows, Linux, and macOS. PsExec A tool designed to run programs that SafePay threat actors use to execute commands on remote systems. RClone A legitimate command-line program used to sync files with cloud storage services, such as Mega. SafePay threat actors maliciously use RClone for data packaging and movement. ScreenConnect A remote support, access, and meeting software that allows users to control devices remotely over the internet. SafePay threat actors use ScreenConnect for persistence and access. ShareFinder.ps1 A PowerShell script used to scan an Active Directory network for shared folders. SafePay threat actors use ShareFinder.ps1 for exfiltration hunting. WinRAR Archive utility used to split compromised data into segments and to compress [ T1560.001 ] files into a .RAR format prior to exfiltration. SafePay threat actors use WinRAR for data packaging and movement. WinRM A Windows-based protocol designed to facilitate remote management and automation. SafePay threat actors use WinRM for command execution. AnyDesk and TeamViewer Legitimate remote desktop tool used for accessing and controlling computers over the internet. SafePay threat actors use AnyDesk and TeamViewer to transfer malware to the victim’s system. AcronisDiskDirector A legitimate disk management tool. SharpShares.exe A network scanning tool used for host discovery and enumeration. NetExec A legitimate network assessment tool to enumerate systems, validate credentials, and manage remote operations across private networks. Backblaze A command-line tool for file management within Backblaze B2 cloud storage. SafePay threat actors executed commands via b2.exe to exfiltrate a victim’s data. Indicators of Compromise Table 2 through Table 5 list IOCs associated with SafePay ransomware that allowed for the identification of malicious activity. Disclaimer: The authoring agencies recommend organizations investigate or verify IP addresses prior to taking action, such as blocking. These IOCs were observed between November 2024 and August 2026. Table 2. IP Addresses IP Address Description 104.26.2[.]223 SafePay victim intrusion 140.82.114[.]4 SafePay victim intrusion 185.199.108[.]133 SafePay victim intrusion 77.37.49[.]40 SafePay victim intrusion 173.194.194[.]94 Hosting victim data 167.235.225[.]149 Client login panels 5.255.11[.]134 Used in exfiltration 88.119.167[.]239 soc.dll command and control 37.10.71[.]188 Used in exfiltration Note: Some of these files are legitimate tools. The authoring organizations recommend organizations investigate or verify tool use prior to taking action, such as blocking. Table 3. Malicious Files Filename Description 1 - Copy.bat A batch script likely used to copy, stage, or move files during lateral movement or data collection. CCleaner.exe/ CCleaner64.exe A legitimate system utility; however, it is suspicious if deployed in enterprise environments for file cleanup or anti-forensics. CCleaner*.exe / *.dll A file used for potential masquerading or abuse of CCleaner components for execution or persistence. dcsync.exe A tool used to perform DCSync operations to extract Active Directory credentials; high-confidence credential theft activity. domains.txt An output file likely containing enumerated domain information. DYRasWtb.exe A suspected malicious executable. libsmb2.dll A library associated with Server Message Block (SMB) communication; may support lateral movement or file transfer. Libwa*.dll A suspicious library set; likely part of a custom toolset or malware framework; requires further analysis. License.txt A benign file that may accompany tool packages or be used for masquerading. In one instance, it accompanied the tool “S.P_Network Scanner.” locker.dll A potential ransomware or encryption-related component. netscan.exe A network scanning tool used for host discovery and enumeration. netscan.lic / netscan.xml Output or configuration files associated with network scanning activity. netscanNEW.zip Archive file potentially used to stage or transfer scanning tools. nltest.exe Legitimate Windows tool used for domain trust enumeration; suspicious when used outside admin workflows. oui.txt A MAC address vendor lookup output—network reconnaissance artifact. ping.txt An output file from network connectivity testing. portable.dat A potential configuration or staging file (context-dependent). scan.xml An output file from scanning/enumeration tools. sharefinder.ps1 A PowerShell script used to enumerate network shares (reconnaissance). Socks.exe A tool used to establish SOCKS proxy for tunneling traffic. Socks_werfault.exe A binary likely masquerading to blend with Windows processes. subs.txt A possible staging file or list of targets/data for exfiltration. svchost.exe A legitimate Windows process; suspicious if located outside System32 or used for masquerading. wa_3rd_party_host_*.exe A file of suspicious binaries—likely part of SafePay threat actor toolset or masquerading components. winrar.exe A legitimate archiving tool frequently used for data staging prior to exfiltration. AnyDesk.exe A legitimate remote desktop tool for accessing and controlling computers over the internet; most of the time it is used to transfer malware to a victim’s system. SharpShares.exe A network scanning tool used for host discovery and enumeration. AcronisDiskDirector-12.5 / acro.exe / DiskDirector.exe / Acronis.exe A legitimate disk management tool. b2.exe A command-line tool for data exfiltration to Backblaze B2 cloud storage. nxc.exe The executable for NetExec, a legitimate network assessment tool used to enumerate systems, validate credentials, and manage remote operations across private networks. Table 4. SHA-1 Hash Values Hash File/Description 07353237350c35d6dc2c8f143b649cd07c71f62b 1.exe (ransomware binary) b498a2683640c983bb069fa2ea9e67cef4a3797d Locker.dll PE32 executable BBFED53E3BB1F306F4DA97D995CF4AE5B73AD081 locker.dll d711a5af5aed48a3b36b98f4fcf52809aebef7a2 nxc Table 5. SHA-256 Hash Files Hash File/Description 921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae soc.dll 6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a RunPE bundled DLL e79608cf1d6b51324c14bef8883054c1238ed5f080222cc464810e6e14adc346 Injected PE 327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917 locker.dll PE32 executable a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526 locker.dll BBDD3620A67AEDEC4B9A68B2C9CC880B6631215E129816AEA19902A6F4BC6F41 SharpShares.exe The following are IOC hostnames: WIN-SBOE3CPNAL WIN-3IUUOFVTQAR WIN-DK18BI83M0S WIN-I1HRRJHCEIV MITRE ATT&CK Tactics and Techniques See Table 6 through Table 16 for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool . Table 6. Initial Access Technique Title ID Use External Remote Services T1133 SafePay threat actors use external remote services, such as VPNs or other tools, to externally connect to an internal network. Exploit Public-Facing Application T1190 SafePay threat actors attempt to exploit a vulnerability within a system to gain access. Common vulnerabilities include software bugs, glitches, or misconfigurations. Table 7. Execution Technique Title ID Use Command and Scripting Interpreter: PowerShell T1059.001 SafePay threat actors use PowerShell, an interactive command-line interface and scripting environment contained within Windows, to identify code within a targeted network. Command and Scripting Interpreter: Windows Command Shell T1059.003 SafePay threat actors use the Windows command shell prompt to gain control of a component on a system that requires specific permissions depending on the command executed. System Services: Service Execution T1569.002 SafePay threat actors use tools, such as PsExec, to execute commands on remote systems. Command and Scripting Interpreter T1059 SafePay threat actors use Windows UAC to elevate a program’s privileges, enabling the execution of malicious commands or binaries. Table 8. Persistence Technique Title ID Use Account Manipulation T1098 SafePay threat actors establish persistence by gaining administrative privileges on existing accounts. Table 9. Privilege Escalation Technique Title ID Use Abuse Elevation Control Mechanism: Bypass User Account Control T1548.002 SafePay threat actors use Windows UAC to elevate a program’s privileges and execute a task on an administrator-level permission scale. Table 10. Stealth Technique Title ID Use Obfuscated Files or Information: Software Packing T1027.002 SafePay threat actors use software packing to conceal malicious code by means of encrypting an executable to avoid detection. Indicator Removal: File Deletion T1070.004 SafePay threat actors delete files associated with the intrusion activity to minimize their digital footprint and obfuscate malicious activities. System Binary Proxy Execution T1218 SafePay threat actors proxy the execution of malicious content with a trusted binary, often a Microsoft-signed file, to bypass signature-based network defenses. Table 11. Defense Impairment Technique Title ID Use Disable or Modify Tools T1685 SafePay threat actors disable security features, modify or delete registry keys or configuration files to impair functionality, and disable updates such as security patches on a system or network. Table 12. Credential Access Technique Title ID Use Brute Force T1110 SafePay threat actors gain access to accounts by implementing brute force password attacks. Table 13. Lateral Movement Technique Title ID Use Remote Services: Remote Desktop Protocol T1021.001 SafePay threat actors gain access to a valid account using RDP and typically disable cybersecurity features, such as Windows Defender, while using LOLBins. Remote Services: SMB/Windows Admin Shares T1021.002 SafePay threat actors gain access to a valid account using SMB to enable lateral movement throughout a network. Remote Services T1021 SafePay threat actors employ remote services to expand their presence within the compromised network. Remote Services: Windows Remote Management T1021.006 SafePay threat actors use tools, such as WinRM, to execute commands on remote systems. Table 14. Collection Technique Title ID Use Archive Collected Data: Archive via Utility T1560.001 SafePay threat actors use utilities to compress or encrypt collected data prior to exfiltration to change the format of the data to one compatible for transportation. Archive Collected Data: Archive via Library T1560.002 SafePay threat actors use credential dumpers, such as Mimikatz, for password exfiltration. Table 15. Exfiltration Technique Title ID Use Exfiltration Over Alternative Protocol T1048 SafePay threat actors exfiltrate data over an alternative protocol, including file transfer protocol, simple mail transfer protocol, HTTP/S, domain name system, SMB, or another network protocol variation that is not the main or current command and control channel. Exfiltration Over Web Service T1567 SafePay threat actors exfiltrate data over web services, such as OneDrive. Table 16. Impact Technique Title ID Use Data Encrypted for Impact T1486 SafePay threat actors encrypt data on targeted systems to disrupt access to a particular system or network service. They then demand a ransom payment in exchange for a decryption key. Inhibit System Recovery T1490 SafePay threat actors disable services designed to assist in recovery of a corrupted system. In some cases, SafePay threat actors deleted all network-attached backups of company data. Incident Response If a potential compromise is detected, but ransomware actors have not (yet) encrypted items, organizations should take the following actions: Determine which hosts were compromised and isolate them by quarantining or taking them offline. Initiate threat hunting activities to scope the intrusion . Collect and review relevant artifacts, logs, and other data to identify threat actor TTPs, compromised devices and accounts, a timeline of activity, etc. Report the suspected compromise to the FBI and other agencies as appropriate (if located within the U.K., report the compromise to Report Fraud or local police force ) (see the Reporting section for contact information). Apply eviction countermeasures , including those listed below, to contain the incident and eradicate the threat actor from the network ( Note: Start applying countermeasures after collecting enough threat hunting data to inform effective countermeasure selection; this will likely overlap with threat hunting activities). Use CISA’s Eviction Strategies Tool to assemble countermeasures for a systematic eviction plan—the tool comprises Playbook-NG (a web application) and COUN7ER (a database of post-compromise countermeasures mapped to adversary TTPs). Use Playbook-NG and COUN7ER together to assemble a systematic eviction plan, or playbook, that leverages distinct countermeasures to contain and evict cyber threat actors. The playbook features a list of recommended response actions based on threat actor TTPs and includes each action’s intended outcome, preparatory steps, and associated risks. For more information, see CISA’s Eviction Strategies Tool fact sheet. Harden the network to prevent additional malicious activity (see Mitigations for guidance). If compromise is detected and items have been encrypted, see the “Ransomware and Data Extortion Response Checklist” in CISA’s joint #StopRansomware Guide . Mitigations The authoring agencies recommend organizations implement the mitigations below to improve their cybersecurity posture on the basis of the threat actors’ activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections. Organizations should implement the following mitigations: Prioritize remediating known exploited vulnerabilities (KEVs) and keep all operating systems, software, and firmware up to date , as timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to cybersecurity threats; specifically, prioritize patching KEVs in internet-facing systems. [ CPG 2.B ]. Additionally, using Binding Operational Directive 26-04 offers a framework for patch prioritization based on technology type and steps for forensics triage. Under its implementation guidance, it offers guidance and steps to perform forensic triage for severe vulnerability cases. Implement identity, credential, and access management (ICAM) policies across the organization and require MFA for all services to the greatest extent possible—particularly for webmail, VPNs, and accounts that access critical systems [ CPG 3.F ]. Require all accounts with password logins (e.g., service accounts, admin accounts, and domain admin accounts) to comply with NIST’s digital identity guidelines ; require employees to use long passwords and consider not requiring recurring password changes, as these can weaken security [ CPG 3.B ]. Use longer passwords consisting of at least 15 characters and no more than 64 characters in length. Store passwords in a hashed format using industry-recognized password managers. Add password user “salts” to shared login credentials. Avoid reusing passwords [ CPG 3.C ]. Implement multiple failed login attempt account lockouts [ CPG 3.E ]. Disable password “hints.” Refrain from requiring password changes more frequently than once per year. Note: NIST guidance suggests favoring longer passwords instead of requiring frequent password resets. Frequent password resets are more likely to result in users developing password patterns cyber threat actors can easily decipher. Maintain offline backups of data and regularly test and maintain backup and restoration processes [ CPG 3.O ]; implementing this practice helps organizations avoid severe operational interruptions and prevents scenarios in which data is irretrievable. Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted), and covers the entire organization’s data infrastructure [ CPG 3.K ]. Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, and secure location (e.g., hard drives, storage devices, or the cloud) [ CPG 3.I , 3.O , 1.C ]. Segment networks to prevent the spread of ransomware, as network segmentation can help control traffic flows between, and access to, various subnetworks and restrict adversary lateral movement [ CPG 3.I ]. Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware with a network monitoring tool [ CPG 4.B ]. To aid in detecting ransomware, implement a tool that logs and reports all network traffic, including lateral movement activity on a network. Endpoint Detection and Response (EDR) tools are particularly useful for detecting lateral connections as they have insight into common and uncommon network connections for each host. Filter network traffic by preventing unknown or untrusted origins from accessing remote services on internal systems—this prevents threat actors from directly connecting to remote access services that they have established for persistence. Review domain controllers, servers, workstations, and Active Directories for new, unactive and/or unrecognized accounts. Disable unused ports . Consider adding an email banner to emails received from outside of your organization. Audit user accounts with administrative privileges and configure access controls according to the principle of least privilege [ CPG 3.G ]. Implement time-based access for accounts set at the admin level and higher ; for example, the Just-in-Time (JIT) access method provisions privileged access when needed and can support enforcement of the principle of least privilege (as well as the Zero Trust Maturity Model ). This is a process where a network-wide policy is set in place to automatically disable admin accounts at the Active Directory level when the account is not in direct need. Individual users may submit their requests through an automated process that grants them access to a specified system for a set timeframe when they need to support the completion of a certain task. Disable command-line and scripting activities and permissions, since privilege escalation and lateral movement often depend on software utilities running from the command line; if threat actors cannot run these tools, they will have difficulty escalating privileges and moving laterally [ CPG 3.M ]. These mitigations align with principles provided in the joint guide Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software . CISA urges software manufacturers to take ownership of improving the security outcomes of their customers by applying these and other secure by design tactics. By implementing secure by design tactics, software manufacturers can make their product lines secure “out of the box” without requiring customers to make additional configuration changes, purchasing product security add-in software and logs, monitoring, and making frequent security updates. Validate Security Controls In addition to applying mitigations, the authoring agencies recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory. To get started: Select an ATT&CK technique described in this advisory (see Table 6 to Table 16 ). Align your security technologies against the technique. Test your technologies against the technique. Analyze your detection and prevention technologies’ performance. Repeat the process for all security technologies to obtain a set of comprehensive performance data. Tune your security program, including people, processes, and technologies, based on the data generated by this process. The authoring agencies recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory. Resources Stopransomware.gov is a whole-of-government approach that provides one central location for ransomware resources and alerts. CISA’s #StopRansomware Guide provides organizations with comprehensive best practices to mitigate the risk of ransomware attacks. CISA’s Known Exploited Vulnerabilities Catalog is an authoritative resource for organizations to support improvement of their patch management best practices. CISA’s Multifactor Authentication webpage provides best practices for network defenders to mitigate threats to accounts and systems that use MFA. CISA’s Cyber Hygiene Services help organizations reduce the risk of a successful cyberattack. USSS’s Preparing for a Cyber Incident outlines basic steps an organization can take before, during, and after a cyber incident. CISA’s Cyber Security Evaluation Tool (CSET) provides a systematic, disciplined, and repeatable approach for evaluating an organization’s security posture; see Downloading and Installing CSET for step-by-step guidance to help your organization evaluate cybersecurity practices on your networks. CISA’s Ransomware Risk Assessment helps assess an organization’s ability to counteract a ransomware infection. Department of Health and Human Services’ Cybersecurity Performance Goals is a resource to help healthcare organizations implement high-impact cybersecurity practices. CISA’s Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk and its implementation guidance CISA’s CI Fortify: Strengthening Resilience Across Critical Infrastructure CISA’s Eviction Strategies Tool enables incident response teams to quickly turn observed behaviors into remediation plans U.K.’s National Cyber Security Centre U.K.’s National Crime Agency Reporting Your organization has no obligation to respond or provide information to the FBI and other authoring agencies in response to this joint advisory. If, after reviewing the information provided, your organization decides to provide information to the FBI or other authoring agencies, reporting must be consistent with applicable state and federal laws. The FBI and other authoring agencies are interested in any information, to include boundary logs showing communication to and from foreign IP addresses, a sample ransom note, communications with threat actors, Bitcoin wallet information, decryptor files, and/or a benign sample of an encrypted file. Additional details of interest include a targeted company point of contact, status and scope of infection, estimated loss, operational impact, transaction IDs, date of infection, date detected, initial attack vector, and host- and network-based indicators. The authoring agencies do not encourage paying ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, the FBI and CISA urge you to promptly report ransomware incidents to the FBI’s Internet Crime Complaint Center (IC3) , a local FBI field office , a local USSS Field Office , or CISA via the agency’s Incident Reporting System or its 24/7 Operations Center ( [email protected] ) or by calling 1-844-Say-CISA (1-844-729-2472). In the U.K., report incidents of a cybercrime or fraud at the UK’s Home for Reporting Cyber Crime & Fraud or 0300-123-2040, your local police force , or use the non-emergency number 101. Disclaimer The information in this report is being provided “as is” for informational purposes only. CISA and the FBI/USSS do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by the FBI, CISA, or USSS. The authoring agencies recognize that infrastructure used for malicious activity may be hosted on cloud or virtualized platforms where IP addresses can be dynamically or temporarily assigned. As a result, an address associated with malicious activity at one point in time may later be reassigned to benign services. Accordingly, these indicators should be interpreted as historically observed infrastructure within the activity window and should be corroborated with current network telemetry or additional intelligence sources when used for defensive or investigative purposes. Version History October 20, 2026 : Initial version.

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-20 CISA Advisory

Moxa AIG-302 ThingsPro Edge

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to obtain and disclose sensitive information. The following versions of Moxa AIG-302 ThingsPro Edge are affected: Moxa AIG-302 ThingsPro Edge firmware CVSS Vendor Equipment v3 8.1 Moxa Moxa AIG-302 ThingsPro Edge firmware 2 Vulnerabilities Missing Authorization, Use of Hard-coded Cryptographic Key Background Critical Infrastructure Sectors: Critical Manufacturing, Energy, Water and Wastewater Systems Countries/Areas Deployed: Worldwide Company Headquarters Location: Taiwan Vulnerabilities Expand All + CVE-2026-109812 A missing authorization vulnerability exists in the internal API /api/v1/secrets/ for some of Moxa's industrial computing products. A privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the disclosure of confidential data, including cryptographic key material. Read More 1 Affected Product Moxa Moxa AIG-302 ThingsPro Edge firmware: Product Status: known_affected Remediations Mitigation Moxa has provided a fix for the vulnerability in v1.4.1. Users are encouraged to obtain and apply the update through one of the following methods: Mitigation If the AIG-302 has Internet access, login to the AIG-302 Web Console, go to Maintenance > Software Upgrades, and click Check for upgrades to check for and obtain the update. Mitigation Users can download the v1.4.1 patch manually from either the official AIG-302 product website or the Moxa Software Release Service. Then, log in to the AIG-302 Web Console, navigate to Maintenance > Software Upgrades, and select Package Upload to upload the patch. Mitigation Users can download the v1.4.1 patch manually from either the official AIG-302 product website or the Moxa Software Release Service. Then, log in to the AIG-302 Web Console, navigate to Maintenance > Software Upgrades, and select Package Upload to upload the patch. Mitigation For more information refer to Moxa's security advisory MPSA-262560 Additional Metrics Relevant CWE: CWE-862 Missing Authorization CVSS Version Base Score Base Severity Vector String 3.1 6.8 MEDIUM CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N 4.0 6.9 MEDIUM CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N View CVE Details CVE-2026-109813 A hard-coded cryptographic key vulnerability exists in the /usr/bin/sysman for some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications. Read More 2 Affected Products Moxa Moxa AIG-302 ThingsPro Edge firmware: Product Status: known_affected Remediations Mitigation Moxa has provided a fix for the vulnerability in v1.4.1. Users are encouraged to obtain and apply the update through one of the following methods: Mitigation If the AIG-302 has Internet access, login to the AIG-302 Web Console, go to Maintenance > Software Upgrades, and click Check for upgrades to check for and obtain the update. Mitigation Users can download the v1.4.1 patch manually from either the official AIG-302 product website or the Moxa Software Release Service. Then, log in to the AIG-302 Web Console, navigate to Maintenance > Software Upgrades, and select Package Upload to upload the patch. Mitigation Users can download the v1.4.1 patch manually from either the official AIG-302 product website or the Moxa Software Release Service. Then, log in to the AIG-302 Web Console, navigate to Maintenance > Software Upgrades, and select Package Upload to upload the patch. Mitigation For more information refer to Moxa's security advisory MPSA-262560 Moxa Moxa AIG-302 ThingsPro Edge firmware: Product Status: known_affected Remediations Mitigation Moxa has provided a fix for the vulnerability in v1.4.1. Users are encouraged to obtain and apply the update through one of the following methods: Mitigation If the AIG-302 has Internet access, login to the AIG-302 Web Console, go to Maintenance > Software Upgrades, and click Check for upgrades to check for and obtain the update. Mitigation Users can download the v1.4.1 patch manually from either the official AIG-302 product website or the Moxa Software Release Service. Then, log in to the AIG-302 Web Console, navigate to Maintenance > Software Upgrades, and select Package Upload to upload the patch. Mitigation Users can download the v1.4.1 patch manually from either the official AIG-302 product website or the Moxa Software Release Service. Then, log in to the AIG-302 Web Console, navigate to Maintenance > Software Upgrades, and select Package Upload to upload the patch. Mitigation For more information refer to Moxa's security advisory MPSA-262560 Additional Metrics Relevant CWE: CWE-321 Use of Hard-coded Cryptographic Key CVSS Version Base Score Base Severity Vector String 3.1 8.1 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N 4.0 8.6 HIGH CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N View CVE Details Acknowledgments Ievgen Bondarenko reported these vulnerabilities to CISA. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely. Revision History Initial Release Date: 2026-10-20 Date Revision Summary 2026-10-20 1 Initial Publication Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-20 CISA Advisory

HMS Networks PEAK-System PCAN Windows drivers

View CSAF Summary Successful exploitation of these vulnerabilities could crash the Windows kernel. The following versions of HMS Networks PEAK-System PCAN Windows drivers are affected: PEAK-System Device Driver Setup PCAN Windows CAN device drivers CVSS Vendor Equipment v3 7.1 HMS Networks PEAK-System Device Driver Setup 5 Vulnerabilities Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Improper Validation of Array Index, Untrusted Pointer Dereference, Improper Handling of Length Parameter Inconsistency Background Critical Infrastructure Sectors: Transportation Systems, Healthcare and Public Health, Energy, Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: Sweden Vulnerabilities Expand All + CVE-2026-109576 The parser in PEAK-System PCAN driver correctly detected the malformed record, but the loop iterating the record list advanced its processed-bytes counter even when a record had been rejected as invalid. Read More 2 Affected Products HMS Networks PEAK-System Device Driver Setup: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PCAN Windows CAN device drivers: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. Additional Metrics Relevant CWE: CWE-787 Out-of-bounds Write CVSS Version Base Score Base Severity Vector String 3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H 4.0 6.8 MEDIUM CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N View CVE Details CVE-2026-101103 The PEAK-System PCAN diagnostic call did not validate that the caller-supplied output buffer was large enough to hold the output record. Read More 4 Affected Products HMS Networks PEAK-System Device Driver Setup: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PCAN Windows CAN device drivers: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PEAK-System Device Driver Setup: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PCAN Windows CAN device drivers: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. Additional Metrics Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CVSS Version Base Score Base Severity Vector String 3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H 4.0 6.8 MEDIUM CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N View CVE Details CVE-2026-94188 The copied source field in PEAK-System PCAN is attacker-influenced through the related file-device write path, and the caller can combine a small output allocation with controlled source bytes. Read More 6 Affected Products HMS Networks PEAK-System Device Driver Setup: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PCAN Windows CAN device drivers: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PEAK-System Device Driver Setup: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PCAN Windows CAN device drivers: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PEAK-System Device Driver Setup: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PCAN Windows CAN device drivers: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. Additional Metrics Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CVSS Version Base Score Base Severity Vector String 3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H 4.0 6.8 MEDIUM CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N View CVE Details CVE-2026-103672 The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC Read More 8 Affected Products HMS Networks PEAK-System Device Driver Setup: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PCAN Windows CAN device drivers: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PEAK-System Device Driver Setup: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PCAN Windows CAN device drivers: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PEAK-System Device Driver Setup: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PCAN Windows CAN device drivers: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PEAK-System Device Driver Setup: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PCAN Windows CAN device drivers: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. Additional Metrics Relevant CWE: CWE-129 Improper Validation of Array Index CVSS Version Base Score Base Severity Vector String 3.1 7.1 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H 4.0 6.9 MEDIUM CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N View CVE Details CVE-2026-110322 The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields during post-processing. Read More 10 Affected Products HMS Networks PEAK-System Device Driver Setup: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PCAN Windows CAN device drivers: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PEAK-System Device Driver Setup: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PCAN Windows CAN device drivers: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PEAK-System Device Driver Setup: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PCAN Windows CAN device drivers: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PEAK-System Device Driver Setup: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PCAN Windows CAN device drivers: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PEAK-System Device Driver Setup: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PCAN Windows CAN device drivers: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. Additional Metrics Relevant CWE: CWE-822 Untrusted Pointer Dereference CVSS Version Base Score Base Severity Vector String 3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H 4.0 6.8 MEDIUM CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N View CVE Details CVE-2026-105960 PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. The driver uses a requested or queued record count without sufficiently capping the copy to the actual caller-supplied output length. Read More 12 Affected Products HMS Networks PEAK-System Device Driver Setup: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PCAN Windows CAN device drivers: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PEAK-System Device Driver Setup: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PCAN Windows CAN device drivers: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PEAK-System Device Driver Setup: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PCAN Windows CAN device drivers: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PEAK-System Device Driver Setup: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PCAN Windows CAN device drivers: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PEAK-System Device Driver Setup: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PCAN Windows CAN device drivers: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PEAK-System Device Driver Setup: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. HMS Networks PCAN Windows CAN device drivers: Product Status: known_affected Remediations Mitigation HMS Networks AB has addressed the issue in version 5.1.4 and recommends that users upgrade to the newest available version. Users can find software updates for PEAK-System PCAN on the software download page. Mitigation For more information see the associated HMS security advisory. Additional Metrics Relevant CWE: CWE-130 Improper Handling of Length Parameter Inconsistency CVSS Version Base Score Base Severity Vector String 3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H 4.0 6.8 MEDIUM CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N View CVE Details Acknowledgments Seyeon Bang reported these vulnerabilities to CISA. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely. Revision History Initial Release Date: 2026-10-20 Date Revision Summary 2026-10-20 1 Initial Publication Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Critical CISA Advisory

2026-10-16 CISA Advisory

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities . CISA will continue to add vulnerabilities to the catalog that meet the specified criteria . Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form . Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Critical CISA Advisory

2026-10-16 CISA Advisory

CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support

CISA is aware of critical authentication bypass vulnerability CVE-2026-102764 , affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade first. Cyber threat actors are actively exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalog on Oct. 16, 2026. CISA urges organizations with affected self-hosted Remote Support appliances to immediately take the following actions: Apply the BT26-05-RS patch, as outlined in BeyondTrust’s Security Advisory BT26-05 . Organizations on a self-hosted Remote Support version older than 24.3.1 will need to upgrade to a newer version to apply the patch. Organizations using BeyondTrust-hosted (SaaS) Remote Support deployments have already been patched. Review BeyondTrust’s blog ARMORY CASTLE and BT26-05: What Security Teams Need to Know for detailed information on the vulnerability and recommended response and mitigation actions. Limit external access to the Remote Support appliance to the services needed to support users and customers. Restrict access to administrative interfaces to trusted networks. Review BeyondTrust’s B Series Appliance on-premises security for additional guidance on securing network connectivity for self-hosted Remote Support appliances. Organizations with affected self-hosted Remote Support appliances should conduct network and memory forensics to identify evidence of potential compromise. If your organization suspects a compromise, CISA recommends taking the following actions: Isolate any suspected or confirmed compromised appliances. Collect a snapshot of virtual appliances or forensic image for physical appliances to conduct future forensics, immediately forward appliance syslog and session events to the SIEM, and collect any additional logs, such as web application firewall, reverse-proxy, or perimeter firewall logs for the exposure window. Consult BeyondTrust’s Syslog guide for additional information on forwarding appliance logs and session events. Conduct network and forensic investigations for evidence of compromise. Additionally, hunt for indicators of threat actor activity, including unrecognized privileged or administrative sessions, unrecognized script files, unexpected gaps in logs or log forwarding, and unauthorized account, permission, or session-policy changes. Consult CISA’s Binding Operational Directive (BOD) 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk to assist with prioritizing vulnerability remediation. Rebuild from a known-good state and apply the BT26-05-RS patch. Then rotate every credential the appliance stored or injected, revoke all active support sessions, and review new multifactor authentication registrations on privileged accounts. CISA urges organizations to review the BeyondTrust security advisory and resources noted above and apply necessary updates. CISA also recommends reviewing Mandiant’s blog, ARMORY CASTLE Exploits BeyondTrust , for additional hunt and isolation guidance and detections. Disclaimer The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-16 CISA Advisory

Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation

The National Institute of Standards and Technology (NIST), National Security Agency’s Super Intelligence Security Center (NSA SISC) and Cybersecurity and Infrastructure Security Agency (CISA) published Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation . The product outlines ten voluntary core practices to help organizations that train and evaluate highly capable super intelligence (SI) agents—particularly pre-deployment, cutting edge SI agents with reduced safeguards or other high-risk, non-public systems—prepare for and manage SI control incidents. A SI control incident occurs when one or more SI agents takes uninstructed actions that conflict with or compromise policies, controls, or security measures that scope the task and provide human oversight. This product aligns with cyber incident response best practices, includes additional SI considerations and highlights the importance of testing controls and validating containment before resuming SI agent activities. It addresses: measures for limiting agent access to information, systems, tools, and networks; monitoring for unexpected activity; preserving evidence and shutting down undesired behavior; rebuilding from verified baselines; and reporting incidents and near-misses to relevant government agencies and affected parties. For more information and resources visit CISA’s Super Intelligence page.

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-16 CISA Advisory

Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials

CISA and the Federal Bureau of Investigation (FBI) released a Public Service Announcement (PSA) warning election and campaign officials about cyber threats during the 2026 U.S. midterm elections. Malicious cyber actors may use phishing and smishing techniques to steal login credentials and other sensitive information or install malware on targeted devices. Election officials, candidates, and political organizations may be attractive targets because of their access to voter registration data, current government officials, and sensitive campaign information. Cyber actors are increasingly using sophisticated phishing and smishing campaigns that closely resemble legitimate communications. These efforts may include convincing emails, text messages, audio, and video content designed to manipulate recipients into disclosing sensitive information or interacting with malicious links and attachments. CISA and the FBI urge election officials, campaign personnel, and the public to review the PSA, follow recommended cybersecurity practices, and remain vigilant for suspicious emails and mobile messages.

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-15 CISA Advisory

Eclipse Foundation Eclipse Milo

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients. The following versions of Eclipse Foundation Eclipse Milo are affected: Eclipse Milo >=0.6.0| Eclipse Milo >=1.0.0| CVSS Vendor Equipment v3 8.2 Eclipse Foundation Eclipse Milo 5 Vulnerabilities Incorrect Authorization, Missing Release of Memory after Effective Lifetime, Missing Authorization, Observable Response Discrepancy, Missing Release of Resource after Effective Lifetime Background Critical Infrastructure Sectors: Chemical, Critical Manufacturing, Energy, Water and Wastewater Countries/Areas Deployed: Worldwide Company Headquarters Location: Belgium Vulnerabilities Expand All + CVE-2026-62927 In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method. Read More 1 Affected Product Eclipse Foundation Eclipse Milo: >=1.0.0| Product Status: known_affected Remediations Vendor fix The Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5. Mitigation For users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later. Additional Metrics Relevant CWE: CWE-863 Incorrect Authorization CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N 4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N View CVE Details CVE-2026-63252 In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially terminating the server. Read More 2 Affected Products Eclipse Foundation Eclipse Milo: >=1.0.0| Product Status: known_affected Remediations Eclipse Foundation Eclipse Milo: >=0.6.0| Product Status: known_affected Remediations Vendor fix The Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5. Mitigation For users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later. Additional Metrics Relevant CWE: CWE-401 Missing Release of Memory after Effective Lifetime CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N View CVE Details CVE-2026-58080 In Eclipse Milo versions 1.0.0 through 1.1.4, OpcUaServerConfig.copy() fails to preserve a configured RoleMapper. On servers that rely on role permissions and construct the running configuration through copy(), sessions receive no role IDs and the default access controller skips role-permission checks, allowing an anonymous client where anonymous sessions are permitted to read role-permission metadata, invoke protected methods, or delete protected nodes. Read More 3 Affected Products Eclipse Foundation Eclipse Milo: >=1.0.0| Product Status: known_affected Remediations Vendor fix The Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5. Mitigation For users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later. Eclipse Foundation Eclipse Milo: >=0.6.0| Product Status: known_affected Remediations Eclipse Foundation Eclipse Milo: >=1.0.0| Product Status: known_affected Remediations Vendor fix The Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5. Mitigation For users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later. Additional Metrics Relevant CWE: CWE-862 Missing Authorization CVSS Version Base Score Base Severity Vector String 3.1 8.2 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N 4.0 8.8 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N View CVE Details CVE-2026-63248 In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates. Read More 4 Affected Products Eclipse Foundation Eclipse Milo: >=1.0.0| Product Status: known_affected Remediations Eclipse Foundation Eclipse Milo: >=0.6.0| Product Status: known_affected Remediations Vendor fix The Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5. Mitigation For users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later. Eclipse Foundation Eclipse Milo: >=1.0.0| Product Status: known_affected Remediations Eclipse Foundation Eclipse Milo: >=0.6.0| Product Status: known_affected Remediations Vendor fix The Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5. Mitigation For users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later. Additional Metrics Relevant CWE: CWE-862 Missing Authorization CVSS Version Base Score Base Severity Vector String 3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 4.0 6.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N View CVE Details CVE-2026-60007 In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated ActivateSession requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials. Read More 5 Affected Products Eclipse Foundation Eclipse Milo: >=1.0.0| Product Status: known_affected Remediations Eclipse Foundation Eclipse Milo: >=0.6.0| Product Status: known_affected Remediations Vendor fix The Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5. Mitigation For users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later. Eclipse Foundation Eclipse Milo: >=1.0.0| Product Status: known_affected Remediations Eclipse Foundation Eclipse Milo: >=0.6.0| Product Status: known_affected Remediations Vendor fix The Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5. Mitigation For users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later. Eclipse Foundation Eclipse Milo: >=0.6.0| Product Status: known_affected Remediations Vendor fix The Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5. Mitigation For users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later. Additional Metrics Relevant CWE: CWE-204 Observable Response Discrepancy CVSS Version Base Score Base Severity Vector String 3.1 7.4 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N 4.0 9.1 CRITICAL CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N View CVE Details CVE-2026-61387 In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter can trigger a StackOverflowError during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from creating new monitored items until restart. Existing monitored items and other server functions remain unaffected. Read More 6 Affected Products Eclipse Foundation Eclipse Milo: >=1.0.0| Product Status: known_affected Remediations Vendor fix The Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5. Mitigation For users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later. Eclipse Foundation Eclipse Milo: >=0.6.0| Product Status: known_affected Remediations Eclipse Foundation Eclipse Milo: >=1.0.0| Product Status: known_affected Remediations Vendor fix The Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5. Mitigation For users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later. Eclipse Foundation Eclipse Milo: >=0.6.0| Product Status: known_affected Remediations Eclipse Foundation Eclipse Milo: >=0.6.0| Product Status: known_affected Remediations Eclipse Foundation Eclipse Milo: >=1.0.0| Product Status: known_affected Remediations Vendor fix The Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5. Mitigation For users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later. Additional Metrics Relevant CWE: CWE-772 Missing Release of Resource after Effective Lifetime CVSS Version Base Score Base Severity Vector String 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L 4.0 6.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N View CVE Details Acknowledgments Abhinav Agarwal reported these vulnerabilities to CISA. Legal Notice and Terms of Use This product is provided subject to this Notification ( https://www.cisa.gov/notification ) and this Privacy & Use policy ( https://www.cisa.gov/privacy-policy ). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Revision History Initial Release Date: 2026-10-15 Date Revision Summary 2026-10-15 1 Initial Publication Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Critical CISA Advisory

2026-10-15 CISA Advisory

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities . CISA will continue to add vulnerabilities to the catalog that meet the specified criteria . Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form . Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-15 CISA Advisory

J4Care dcm4che

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files, and cause a denial-of-service condition. The following versions of J4Care dcm4che are affected: dcm4chee-arc-light 5.35.1 (CVE-2026-97851, CVE-2026-107621, CVE-2026-105273, CVE-2026-101021, CVE-2026-105279, CVE-2026-105667) CVSS Vendor Equipment v3 9.1 J4Care dcm4chee-arc-light 4 Vulnerabilities Missing Authorization, Loop with Unreachable Exit Condition ('Infinite Loop'), Inefficient Algorithmic Complexity, Missing Authentication for Critical Function Background Critical Infrastructure Sectors: Healthcare and Public Health Countries/Areas Deployed: Worldwide Company Headquarters Location: Austria Vulnerabilities Expand All + CVE-2026-97851 The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database. Read More 1 Affected Product J4Care dcm4chee-arc-light: 5.35.1 Product Status: known_affected Remediations Mitigation J4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later. Additional Metrics Relevant CWE: CWE-862 Missing Authorization CVSS Version Base Score Base Severity Vector String 3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H 4.0 8.8 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N View CVE Details CVE-2026-107621 JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream. Read More 2 Affected Products J4Care dcm4chee-arc-light: 5.35.1 Product Status: known_affected Remediations Mitigation J4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later. J4Care dcm4chee-arc-light: 5.35.1 Product Status: known_affected Remediations Mitigation J4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later. Additional Metrics Relevant CWE: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop') CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N View CVE Details CVE-2026-105273 MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input. Read More 3 Affected Products J4Care dcm4chee-arc-light: 5.35.1 Product Status: known_affected Remediations Mitigation J4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later. J4Care dcm4chee-arc-light: 5.35.1 Product Status: known_affected Remediations Mitigation J4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later. J4Care dcm4chee-arc-light: 5.35.1 Product Status: known_affected Remediations Mitigation J4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later. Additional Metrics Relevant CWE: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop') CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N View CVE Details CVE-2026-101021 MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying. Read More 4 Affected Products J4Care dcm4chee-arc-light: 5.35.1 Product Status: known_affected Remediations Mitigation J4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later. J4Care dcm4chee-arc-light: 5.35.1 Product Status: known_affected Remediations Mitigation J4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later. J4Care dcm4chee-arc-light: 5.35.1 Product Status: known_affected Remediations Mitigation J4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later. J4Care dcm4chee-arc-light: 5.35.1 Product Status: known_affected Remediations Mitigation J4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later. Additional Metrics Relevant CWE: CWE-407 Inefficient Algorithmic Complexity CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N View CVE Details CVE-2026-105279 In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity. Read More 5 Affected Products J4Care dcm4chee-arc-light: 5.35.1 Product Status: known_affected Remediations Mitigation J4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later. J4Care dcm4chee-arc-light: 5.35.1 Product Status: known_affected Remediations Mitigation J4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later. J4Care dcm4chee-arc-light: 5.35.1 Product Status: known_affected Remediations Mitigation J4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later. J4Care dcm4chee-arc-light: 5.35.1 Product Status: known_affected Remediations Mitigation J4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later. J4Care dcm4chee-arc-light: 5.35.1 Product Status: known_affected Remediations Mitigation J4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later. Additional Metrics Relevant CWE: CWE-306 Missing Authentication for Critical Function CVSS Version Base Score Base Severity Vector String 3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N 4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N View CVE Details CVE-2026-105667 In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this. Read More 6 Affected Products J4Care dcm4chee-arc-light: 5.35.1 Product Status: known_affected Remediations Mitigation J4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later. J4Care dcm4chee-arc-light: 5.35.1 Product Status: known_affected Remediations Mitigation J4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later. J4Care dcm4chee-arc-light: 5.35.1 Product Status: known_affected Remediations Mitigation J4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later. J4Care dcm4chee-arc-light: 5.35.1 Product Status: known_affected Remediations Mitigation J4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later. J4Care dcm4chee-arc-light: 5.35.1 Product Status: known_affected Remediations Mitigation J4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later. J4Care dcm4chee-arc-light: 5.35.1 Product Status: known_affected Remediations Mitigation J4Care has provided a fix for the vulnerabilities. J4Care recommends users implement release 5.35.2 or later. Additional Metrics Relevant CWE: CWE-306 Missing Authentication for Critical Function CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N 4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N View CVE Details Acknowledgments Abhinav Agarwal reported these vulnerabilities to CISA. Legal Notice and Terms of Use This product is provided subject to this Notification ( https://www.cisa.gov/notification ) and this Privacy & Use policy ( https://www.cisa.gov/privacy-policy ). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. Revision History Initial Release Date: 2026-10-15 Date Revision Summary 2026-10-15 1 Initial Publication Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-15 CISA Advisory

Thermo Fisher Torrent Suite Software

View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the Torrent Server. The following versions of Thermo Fisher Torrent Suite Software are affected: Torrent Suite Software CVSS Vendor Equipment v3 6.5 Thermo Fisher Torrent Suite Software 1 Vulnerability Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Background Critical Infrastructure Sectors: Healthcare and Public Health Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities CVE-2026-107777 The affected product is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account. Read More 1 Affected Product Thermo Fisher Torrent Suite Software: Product Status: known_affected Remediations Vendor fix Thermo Fisher has fixed the vulnerability and recommends users update Torrent Suite Software to version 5.22 or later. Mitigation For more information, refer to Thermo Fisher's Security bulletin. Additional Metrics Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVSS Version Base Score Base Severity Vector String 3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 4.0 7.1 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N View CVE Details Acknowledgments Akanksha Raghvesh and Abhinav Agarwal reported this vulnerability to CISA. Legal Notice and Terms of Use This product is provided subject to this Notification ( https://www.cisa.gov/notification ) and this Privacy & Use policy ( https://www.cisa.gov/privacy-policy ). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. Revision History Initial Release Date: 2026-10-15 Date Revision Summary 2026-10-15 1 Initial Publication Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory