Threat Wire
BleepingComputer [Critical] FBI links $6.3 billion Binance crypto heist to North Korean hackers BleepingComputer [Critical] Alpine Linux rebuilds GitLab after attempted RCE attack CVE-2026-118539 [Critical] Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION CVE-2026-58882 [Critical] SMS of Death: Android under attack, an invisible SMS can block calls and emergency services The Hacker News [Critical] CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key The Hacker News [Critical] FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist CVE-2026-111357 [Critical] U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog BleepingComputer [Critical] Northflank security breach leads to abuse of customers' AI API keys BleepingComputer [Critical] FBI links $6.3 billion Binance crypto heist to North Korean hackers BleepingComputer [Critical] Alpine Linux rebuilds GitLab after attempted RCE attack CVE-2026-118539 [Critical] Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION CVE-2026-58882 [Critical] SMS of Death: Android under attack, an invisible SMS can block calls and emergency services The Hacker News [Critical] CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key The Hacker News [Critical] FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist CVE-2026-111357 [Critical] U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog BleepingComputer [Critical] Northflank security breach leads to abuse of customers' AI API keys

CyberWatch Newsroom Live Intel

Continuous enterprise threat intelligence tracking active in-the-wild zero-days (CISA KEV), Microsoft Windows KB cumulative updates, MSRC security advisories, and CVE remediation.

Last Checked: Nov 2, 2026 - 02:28:59 UTC (Hourly Auto-Sync Active)
Newsfeed (/feed) RSS Feed JSON API
All Security Bulletins 5,807 Active Zero-Days (KEV) 608 Microsoft Patch KBs 849 MSRC Live Wire 1,922 CISA Advisories 157 Threat Intel 2,629
Showing 24 of 5,807 advisories
Page 36 of 242
CJIS v6.1 Compliance: 5 Practical Priorities for Agencies Moderate BleepingComputer
2026-10-20 BleepingComputer

CJIS v6.1 Compliance: 5 Practical Priorities for Agencies

CJIS v6.1 requires agencies to maintain strong authentication, account security, and audit controls while demonstrating ongoing compliance. Specops outlines five practical priorities covering MFA, account management, passwords, logging, and audit readiness. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Cyber Defense & Malware
Advisory
Abstract links automated response actions directly to SIEM detection rules Moderate Help Net Security
2026-10-20 Help Net Security

Abstract links automated response actions directly to SIEM detection rules

Abstract has announced new AI SOC capabilities in its agentic SIEM: investigation, hunt, and triage powered by a combination of Abstract’s own trained and tuned models and frontier foundation models, and SOAR response capabilities with actions assigned directly to detection rules. The capabilities are built into the platform that already collects, routes, an…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Enterprise Cyber Defense
Advisory
Hacker gets 8 years for stealing $3.3 million from taxpayers Moderate BleepingComputer
2026-10-20 BleepingComputer

Hacker gets 8 years for stealing $3.3 million from taxpayers

A Nigerian national was sentenced to eight years in prison for his involvement in a series of spearphishing attacks targeting US tax preparation businesses since 2019. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Cyber Defense & Malware
Advisory
ThreatModeler NexusAI tracks architectural changes and proposes security updates Moderate Help Net Security
2026-10-20 Help Net Security

ThreatModeler NexusAI tracks architectural changes and proposes security updates

ThreatModeler has announced the launch of NexusAI, its new AI-powered threat modeling partner within the ThreatModeler Nexus platform. NexusAI helps enterprises automate more of the work involved in creating, analyzing, and maintaining threat models, enabling security teams to scale their impact without scaling manual effort. As AI accelerates application de…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Enterprise Cyber Defense
Advisory
IDENTOS PolicyArc gives AI agents task-specific, time-limited access Moderate Help Net Security
2026-10-20 Help Net Security

IDENTOS PolicyArc gives AI agents task-specific, time-limited access

IDENTOS has announced that PolicyArc is now generally available. The new solution gives security, platform, and compliance teams a single place to define, enforce, and audit access policy across their applications. PolicyArc is built to solve how to safely extend access not just to people and services but to the AI agents now acting on their behalf. PolicyAr…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Enterprise Cyber Defense
Advisory
Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election Critical The Hacker News
2026-10-20 The Hacker News

Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election

The iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026, the Citizen Lab said on October 19. The finding came six days before Serbia's October 25 snap parliamentary election. The infection used a zero-click exploit, meaning Đokić did…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
AppGate gives OT supervisors live monitoring and session termination controls Moderate Help Net Security
2026-10-20 Help Net Security

AppGate gives OT supervisors live monitoring and session termination controls

AppGate has expanded its zero trust offering for operational technology (OT) with Session Governance capabilities that help critical infrastructure operators reduce third-party access risk, simplify compliance audits and protect operational uptime. The expansion builds on the ZTNA for OT offering AppGate introduced in March 2026. The initial release of AppGa…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Enterprise Cyber Defense
Advisory
Google may add your number to all your accounts: How to stop it Moderate Malwarebytes Labs
2026-10-20 Malwarebytes Labs

Google may add your number to all your accounts: How to stop it

As Android Central reports , users have received unexpected emails telling them their phone number has been verified for secondary Google accounts. Like me and many others, you may have one Google account for everyday use, another for work, and a third for things you would rather keep separate. But if you’re using an Android phone, those accounts may have so…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Malware Outbreaks & Analysis
Advisory
Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign Important CVE-2026-110936 Help Net Security
2026-10-20 Help Net Security

Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign

Siemens has confirmed the active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center, the company’s tool for downloading, installing and managing its software. Siemens first published its security advisory on 15 October 2026, giving the flaw reported by Jose Oregon from Huntress Labs a CVSS v4.0 score of 8.4. On 17 Oc…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Enterprise Cyber Defense
Advisory
Quarantined, but still on your calendar: The explosion of invite-based attacks Important Help Net Security
2026-10-20 Help Net Security

Quarantined, but still on your calendar: The explosion of invite-based attacks

There has been a sharp escalation in attacks that use malicious calendar invites to reach targets, email security providers Check Point and Sublime Security have warned. Sublime recorded a 1,216% month-over-month increase in August 2026, and the first half of September alone surpassed the whole of August by 1,426%. Check Point’s numbers tell a similar story:…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Enterprise Cyber Defense
Advisory
Windows Server 2025 gets support for quick machine recovery Moderate BleepingComputer
2026-10-20 BleepingComputer

Windows Server 2025 gets support for quick machine recovery

Microsoft announced that IT administrators can now use quick machine recovery on Windows Server 2025 after installing the October 2026 security update. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Cyber Defense & Malware
Advisory
Hitachi Energy RTU500 Product Important CISA Advisory
2026-10-20 CISA Advisory

Hitachi Energy RTU500 Product

View CSAF Summary Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. These vulnerabilities if exploited can have impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation. The following versions of Hitachi Energy RTU500 Product are affected: RTU500 series CMU Firmware vers:RTU500_series_CMU_Firmware/>=13.5.1| =13.6.1| =13.7.1| =13.8.1| =12.7.1| CVSS Vendor Equipment v3 8.8 Hitachi Energy RTU500 series CMU Firmware 7 Vulnerabilities NULL Pointer Dereference, Access of Resource Using Incompatible Type ('Type Confusion'), Use After Free, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials, Authentication Bypass by Capture-replay, Authentication Bypass by Primary Weakness Background Critical Infrastructure Sectors: Energy Countries/Areas Deployed: Worldwide Company Headquarters Location: Switzerland Vulnerabilities Expand All + CVE-2026-17539 RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced message queue. This can cause a BCI_IEC104 fatal write error, resulting in connection interruption and restart, and ultimately a denial of service for bidirectional IEC 60870-5-104 communication. Read More 5 Affected Products RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 12.7.8 OR Vendor fix Upgrade to CMU Firmware version 13.9.1 Additional Metrics Relevant CWE: CWE-476 NULL Pointer Dereference CVSS Version Base Score Base Severity Vector String 3.1 5.9 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H View CVE Details CVE-2026-28388 A vulnerability exists in OpenSSL library component of RTU500 that is used for secure HTTPS access, authenticating and establishing encrypted communications with other devices. When processing a malformed delta CRL with a Delta CRL Indicator but no required CRL Number extension, OpenSSL may dereference a NULL pointer, causing a Denial of Service during X.509 certificate verification. Exploitation requires delta CRL processing to be enabled, a relevant freshest CRL condition to be present, and an attacker-supplied malformed CRL. The issue is limited to Denial of Service and cannot lead to code execution or memory disclosure. Read More 10 Affected Products RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 12.7.8 OR Vendor fix Upgrade to CMU Firmware version 13.9.1 RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 12.7.8 OR Vendor fix Upgrade to CMU Firmware version 13.9.1 Additional Metrics Relevant CWE: CWE-476 NULL Pointer Dereference CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H View CVE Details CVE-2026-6732 The XML-based services used in RTU500 has a vulnerability while processing a specially crafted XSD-validated XML document may trigger a type confusion error in libxml2. An attacker could exploit this condition to cause a denial of service. Read More 14 Affected Products RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* Additional Metrics Relevant CWE: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion') CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H View CVE Details CVE-2026-6653 The XML-based services used in RTU500 has a vulnerability, where a use-after-free vulnerability in the xmlParseInternalSubset function of libxml2 may be triggered by processing specially crafted XML input. Improper handling of entity resolution can allow a remote attacker to cause a denial of service. Read More 19 Affected Products RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 12.7.8 OR Vendor fix Upgrade to CMU Firmware version 13.9.1 RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 12.7.8 OR Vendor fix Upgrade to CMU Firmware version 13.9.1 RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 12.7.8 OR Vendor fix Upgrade to CMU Firmware version 13.9.1 Additional Metrics Relevant CWE: CWE-416 Use After Free CVSS Version Base Score Base Severity Vector String 3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H View CVE Details CVE-2026-6276 A vulnerability exists in the web-based management and services functions of RTU500 using libcurl library, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same easy handle but without the custom `Host:` header set, the second request would use leaked stale information and pass on cookies meant for the first host in the second request. Read More 23 Affected Products RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* Additional Metrics Relevant CWE: CWE-319 Cleartext Transmission of Sensitive Information CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H View CVE Details CVE-2026-9079 A vulnerability exists in the web-based management and services functions of RTU500 using libcurl library. libcurl may fail to clear proxy authentication credentials when instructed to do so. As a result, stale credentials can be reused by subsequent transfers that should not access them, potentially exposing sensitive proxy authentication information. Read More 27 Affected Products RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* Additional Metrics Relevant CWE: CWE-522 Insufficiently Protected Credentials CVSS Version Base Score Base Severity Vector String 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N View CVE Details CVE-2026-11856 A vulnerability exists in the web-based management and services functions of RTU500 using libcurl library. When the same libcurl handle is reused after a transfer to one HTTP origin using Digest authentication, libcurl may incorrectly send the Authorization header intended for the first origin to a second origin. This can disclose authentication information to an unintended host. Read More 31 Affected Products RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* Additional Metrics Relevant CWE: CWE-294 Authentication Bypass by Capture-replay CVSS Version Base Score Base Severity Vector String 3.1 8.1 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H View CVE Details CVE-2026-8927 A vulnerability exists in the web-based management and services functions of RTU500 using libcurl library. When reusing a libcurl handle for sequential transfers with environment-variable proxy configuration, libcurl may fail to clear proxy authentication state between requests. This can leak the Proxy-Authorization header intended for one proxy to another proxy. Read More 35 Affected Products RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* Additional Metrics Relevant CWE: CWE-294 Authentication Bypass by Capture-replay CVSS Version Base Score Base Severity Vector String 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N View CVE Details CVE-2026-8932 A vulnerability exists in the web-based management and services functions of RTU500 using libcurl library. libcurl may reuse an existing connection even after mTLS-related configuration options, especially client certificate or private key settings, have changed. This can bypass the intended authentication configuration and allow use of a connection that should no longer be reused. Read More 39 Affected Products RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 12.7.1 – 12.7.7 Product Status: known_affected Remediations RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* RTU500 series CMU Firmware version 13.5.1 – 13.5.4 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.6.1 – 13.6.3 Product Status: known_affected Remediations Vendor fix Update to CMU Firmware version 13.9.1 Mitigation Follow general mitigation factors/workarounds RTU500 series CMU Firmware version 13.7.1 – 13.7.8 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.7.9 (when available) RTU500 series CMU Firmware version 13.8.1 – 13.8.2 Product Status: known_affected Remediations Mitigation Follow general mitigation factors/workarounds Vendor fix Update to CMU Firmware version 13.9.1 or 13.8.3* Additional Metrics Relevant CWE: CWE-305 Authentication Bypass by Primary Weakness CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N View CVE Details Acknowledgments Hitachi Energy Internal Team reported these vulnerabilities to CISA. Notice The information in this document is subject to change without notice and should not be construed as a commitment by Hitachi Energy. Hitachi Energy provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall Hitachi Energy or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if Hitachi Energy or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from Hitachi Energy and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners. Support For additional information and support please contact your product provider or Hitachi Energy service organization. For contact information, see https://www.hitachienergy.com/contact-us/ for Hitachi Energy contact-centers. General Mitigation Factors Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system. Proper password policies and processes should be followed. Additional information on Industrial Control Systems Cybersecurity Best Practices can be found in the Hitachi Energy “Industrial Control Systems Cybersecurity Best Practices” Cybersecurity Notification. [1] SSVC SSVCv2/E:N/A:N/2026-09-28T14:29:30Z/ Recommended Practices CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability. Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Hitachi Energy PSIRT 8DBD000259 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Hitachi Energy PSIRT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-09-01 Date Revision Summary 2026-09-01 1 Initial public release 2026-09-29 2 Updated fixed version 12.7.8 2026-10-20 3 Initial CISA Republication of Hitachi Energy PSIRT 8DBD000259 advisory Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.
Cybersecurity Advisory
Advisory
CISA Adds Six Known Exploited Vulnerabilities to Catalog Critical CISA Advisory
2026-10-20 CISA Advisory

CISA Adds Six Known Exploited Vulnerabilities to Catalog

CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities . CISA will continue to add vulnerabilities to the catalog that meet the specified criteria . Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form . Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.

Fix: Review CISA guidance and apply vendor security updates immediately.
Cybersecurity Advisory
Advisory
Hitachi Energy MicroSCADA X SYS600 Product Important CISA Advisory
2026-10-20 CISA Advisory

Hitachi Energy MicroSCADA X SYS600 Product

View CSAF Summary Hitachi Energy is aware of multiple vulnerabilities that affect MicroSCADA X SYS600 product versions listed in this document. These vulnerabilities can be exploited to carry out various attacks on the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation. The following versions of Hitachi Energy MicroSCADA X SYS600 Product are affected: MicroSCADA X SYS600 vers:MicroSCADA_X_SYS600/ CVSS Vendor Equipment v3 7.8 Hitachi Energy MicroSCADA X SYS600 2 Vulnerabilities Improper Neutralization of Formula Elements in a CSV File, Incorrect Implementation of Authentication Algorithm Background Critical Infrastructure Sectors: Energy Countries/Areas Deployed: Worldwide Company Headquarters Location: Switzerland Vulnerabilities Expand All + CVE-2026-9852 A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue attackers would need a way to create arbitrary log messages. This could be achieved through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker. This vulnerability affects all Windows users regardless of their privilege level who can run the Notify service and export the log. Read More 1 Affected Product MicroSCADA X SYS600 versions 10.7 and prior Product Status: known_affected Remediations Vendor fix Update to version 10.8 Mitigation Follow general mitigation factors/workarounds Additional Metrics Relevant CWE: CWE-1236 Improper Neutralization of Formula Elements in a CSV File CVSS Version Base Score Base Severity Vector String 3.1 5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N 4.0 4.6 MEDIUM CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N View CVE Details CVE-2026-9853 A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users should be permitted to view and modify application objects. Read More 3 Affected Products MicroSCADA X SYS600 versions 10.7 and prior Product Status: known_affected Remediations Vendor fix Update to version 10.8 and Follow mitigation strategy. Refer to MicroSCADA X SYS00 10.8 Installation and Administration Manual, Section 2.1.7.5 (Mitigation strategy is available for versions 10.3 onwards). Also refer to MicroSCADA X 10.8 Cybersecurity Deployment Guide Mitigation Follow mitigation strategy. Refer to MicroSCADA X SYS00 10.8 Installation and Administration Manual, Section 2.1.7.5 (Mitigation strategy is available for versions 10.3 onwards). Also refer to MicroSCADA X 10.8 Cybersecurity Deployment Guide Mitigation Follow general mitigation factors/workarounds MicroSCADA X SYS600 versions 10.7 and prior Product Status: known_affected Remediations Vendor fix Update to version 10.8 and Follow mitigation strategy. Refer to MicroSCADA X SYS00 10.8 Installation and Administration Manual, Section 2.1.7.5 (Mitigation strategy is available for versions 10.3 onwards). Also refer to MicroSCADA X 10.8 Cybersecurity Deployment Guide Mitigation Follow mitigation strategy. Refer to MicroSCADA X SYS00 10.8 Installation and Administration Manual, Section 2.1.7.5 (Mitigation strategy is available for versions 10.3 onwards). Also refer to MicroSCADA X 10.8 Cybersecurity Deployment Guide Mitigation Follow general mitigation factors/workarounds MicroSCADA X SYS600 version 10.8 Product Status: known_affected Remediations Mitigation Follow mitigation strategy. Refer to MicroSCADA X SYS00 10.8 Installation and Administration Manual, Section 2.1.7.5 (Mitigation strategy is available for versions 10.3 onwards). Also refer to MicroSCADA X 10.8 Cybersecurity Deployment Guide Mitigation Follow general mitigation factors/workarounds Additional Metrics Relevant CWE: CWE-303 Incorrect Implementation of Authentication Algorithm CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 4.0 8.5 HIGH CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N View CVE Details CVE-2026-9854 A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine. Read More 4 Affected Products MicroSCADA X SYS600 versions 10.7 and prior Product Status: known_affected Remediations Vendor fix Update to version 10.8 Mitigation Follow general mitigation factors/workarounds MicroSCADA X SYS600 versions 10.7 and prior Product Status: known_affected Remediations Vendor fix Update to version 10.8 Mitigation Follow general mitigation factors/workarounds MicroSCADA X SYS600 version 10.8 Product Status: known_affected Remediations MicroSCADA X SYS600 versions 10.7 and prior Product Status: known_affected Remediations Vendor fix Update to version 10.8 Mitigation Follow general mitigation factors/workarounds Additional Metrics Relevant CWE: CWE-303 Incorrect Implementation of Authentication Algorithm CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 4.0 8.5 HIGH CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N View CVE Details Acknowledgments Zachary Andrew Wagner, Steven Nicolais, and Timotius Oetnung of the Sandia National Laboratories (CyTRICS program) reported these vulnerabilities to CISA. Notice The information in this document is subject to change without notice and should not be construed as a commitment by Hitachi Energy. Hitachi Energy provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall Hitachi Energy or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if Hitachi Energy or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from Hitachi Energy and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners. Support For additional information and support please contact your product provider or Hitachi Energy service organization. For contact information, see https://www.hitachienergy.com/contact-us/ for Hitachi Energy contact-centers. General Mitigation Factors Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system. Proper password policies and processes should be followed. Additional information on Industrial Control Systems Cybersecurity Best Practices can be found in the Hitachi Energy’s “Industrial Control Systems Cybersecurity Best Practices” Cybersecurity Notification. [1] SSVC SSVCv2/E:N/A:N/2026-09-28T14:40:32Z/ Recommended Practices CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability. Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Hitachi Energy PSIRT 8DBD000249 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Hitachi Energy PSIRT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-09-01 Date Revision Summary 2026-09-01 1 Initial public release 2026-09-29 2 Added researcher’s name under Acknowledgement 2026-10-20 3 Initial CISA Republication of Hitachi Energy PSIRT 8DBD000249 advisory Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.
Cybersecurity Advisory
Advisory
WAGO OS Linux Important CISA Advisory
2026-10-20 CISA Advisory

WAGO OS Linux

View CSAF Summary Two vulnerabilities in the Web-Based Management (WBM) interface of WAGO CC100, PFC100 G2, PFC200 G2, TP600, Edge Controller and WP400 devices allow an authenticated low-privileged user to bypass intended privilege boundaries. The issues affect both the routing configuration functionality and the authorization model for PROFIBUS configuration management. The following versions of WAGO OS Linux are affected: WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| WAGO Firmware (vers:semver/>=1.0.0| CVSS Vendor Equipment v3 8.8 WAGO WAGO Firmware (vers:semver/>=1.0.0| 2 Vulnerabilities Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Missing Authorization Background Critical Infrastructure Sectors: Chemical, Critical Manufacturing, Commercial Facilities, Energy, Transportation Systems, Water and Wastewater Systems Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2026-80466 A vulnerability in the Web-Based Management (WBM) routing configuration allows a low-privileged remote attacker to inject shell commands into routing parameters. Due to insufficient input validation, these values are stored in a configuration file and later processed by a privileged root helper script. Read More 22 Affected Products WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Additional Metrics Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CVSS Version Base Score Base Severity Vector String 3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N View CVE Details CVE-2026-88850 The Web-Based Management (WBM) authorization model does not properly enforce permissions for all PROFIBUS configuration operations. A low-privileged remote attacker can abuse an exposed configuration function to modify root-owned PROFIBUS parameters, including device addressing and SSA settings. This allows unauthorized changes to fieldbus-related configuration and violates the intended privilege boundaries within the management interface. Read More 44 Affected Products WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. WAGO WAGO Firmware (vers:semver/>=1.0.0| Product Status: known_affected Remediations Mitigation WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher. For the latest custom firmware please contact WAGO support. Mitigation WAGO provides security recommendations in the manuals for Controller PFC100 / PFC200 products. Section 6 provides general security recommendations (e.g., restricting physical access), and Section 7 offers additional recommendations (e.g., VPN). Users can find the manuals on the WAGO website: https://www.wago.com/de/d/15739#versions Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Mitigation For more information see WAGO PSIRT or the associated WAGO GmbH & Co. KG security advisory VDE-2026-096 HTML, CSAF. Additional Metrics Relevant CWE: CWE-862 Missing Authorization CVSS Version Base Score Base Severity Vector String 3.1 8.1 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H 4.0 7.2 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N View CVE Details Acknowledgments CERT@VDE coordinated with WAGO. Ievgen Bondarenko reported these vulnerabilities to CISA. Impact Successful exploitation of CVE-2026-80466 may allow a low-privileged attacker to execute commands with root privileges. CVE-2026-88850 allows a low-privileged attacker to perform unauthorized modifications of protected PROFIBUS configuration parameters. Remediation Update to Firmware version 4.10.0 (FW32) or higher. For the latest custom Firmware please contact the WAGO support. Recommended Practices CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability. Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of WAGO GmbH & Co. KG VDE-2026-096 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact WAGO GmbH & Co. KG directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-20 Date Revision Summary 2026-10-20 1 Release version. 2026-10-20 2 Initial CISA Republication of WAGO GmbH & Co. KG VDE-2026-096 advisory Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.
Cybersecurity Advisory
Advisory
#StopRansomware: SafePay Ransomware Critical CISA Advisory
2026-10-20 CISA Advisory

#StopRansomware: SafePay Ransomware

Advisory at a Glance Title #StopRansomware: SafePay Ransomware Original Publication October 20, 2026 Executive Summary This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay actors typically gain access to networks by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using phishing tactics. Once inside the network, SafePay actors establish control by creating new accounts or taking over existing ones. They then use legitimate system tools to move through the network, identify valuable files, and disable security protections to avoid detection. Next, they encrypt the victim’s files, making them inaccessible, and leave a ransom note demanding payment in cryptocurrency. This advisory urges organizations to follow recommended security measures to reduce the risk and impact of SafePay ransomware attacks. Affected Products CVE-2020-3259 [ Common Weakness Enumeration (CWE)-200: Exposure of Sensitive Information to an Unauthorized Actor ] CVE-2023-20269 [ CWE-288: Authentication Bypass Using an Alternate Path or Channel ] CVE-2023-27532 [ CWE-306: Missing Authentication for Critical Function ] CVE-2024-40711 [ CWE-502: Deserialization of Untrusted Data ] CVE-2024-40766 [ CWE-284: Improper Access Control ] Key Actions Regularly patch and update systems, especially firewalls, and other edge devices. Implement Zero Trust Principle. Restrict administrative tools and privileges to necessary users only. Strengthen account security by implementing identity, credential, and access management (ICAM) policies and multifactor authentication (MFA). Indicators of Compromise For a downloadable copy of indicators of compromise, see: AA26-293A STIX XML (40 KB) AA26-293A STIX JSON (38 KB) Intended Audience Organizations: Government; Federal Civilian Executive Branch (FCEB); State, Local, Tribal, and Territorial (SLTT); Critical Infrastructure Roles: Defensive cybersecurity analysts , vulnerability analysts , security systems managers , and operational technology (OT) owners and operators Introduction Note: This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources. The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), United States Secret Service (USSS), Germany’s Landeskriminalamt Rheinland-Pfalz, the United Kingdom’s National Crime Agency, and the United Kingdom’s North West Regional Organised Crime Unit—hereafter referred to as the authoring agencies—are releasing this joint advisory to disseminate known SafePay ransomware TTPs and IOCs identified through FBI, USSS, and Landeskriminalamt Rheinland-Pfalz investigations as recently as August 2026. Since August 2024, SafePay ransomware group’s operations have affected a wide range of businesses and critical infrastructure in North America, South America, Europe, and Australia. SafePay ransomware was among the most active ransomware groups in 2026. The SafePay threat actors have impacted at least 600 separate victims from multiple critical infrastructure sectors. The authoring agencies encourage organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of SafePay ransomware incidents. Download the PDF version of this report: #StopRansomware: SafePay Ransomware (PDF, 1.06 MB ) For a downloadable copy of IOCs, see: AA26-293A-STIX XML (XML, 40.23 KB ) AA26-293A-STIX JSON (JSON, 37.49 KB ) Technical Details Note: This advisory uses the MITRE ATT&CK ® Matrix for Enterprise framework, version 20. See MITRE ATT&CK Tactics and Techniques section of this advisory for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques. Initial Access The FBI, USSS, and cybersecurity researchers observed SafePay threat actors obtaining initial access [ TA0001 ] to organizations through various means, including credential exposure, implementing brute force password attacks [ T1110 ], and exploiting virtual private network (VPN) access. SafePay threat actors use the IP addresses of the VPN provider “Mullvad” to attain initial access—specifically, SafePay threat actors use phished account profiles to access victim networks to exploit the following known Common Vulnerabilities and Exposures (CVEs) for edge device products: CVE-2020-3259 [ Common Weakness Enumeration (CWE)-200: Exposure of Sensitive Information to an Unauthorized Actor ] CVE-2023-20269 [ CWE-288: Authentication Bypass Using an Alternate Path or Channel ] Additionally, the authoring agencies observed SafePay threat actors exploiting the following vulnerabilities across internet-exposed systems [ T1190 ] for initial access through automated scripts: CVE-2023-27532 [ CWE-306: Missing Authentication for Critical Function ] CVE-2024-40711 [ CWE-502: Deserialization of Untrusted Data ] CVE-2024-40766 [ CWE-284: Improper Access Control ] Execution, Persistence, Stealth, and Defense Impairment After SafePay threat actors gain access to a victim network, they establish persistence by gaining administrative privileges on existing accounts [ T1098 ], or on newly created accounts [ T1136 ], using built-in administrative tools consistent with living off the land (LOTL) techniques. Once SafePay threat actors establish a foothold in a victim’s network, they use LOTL binaries (LOLBins) [ T1218 ], such as PsExec [ T1021.002 ] and Windows Remote Management (WinRM) [ T1021.006 ], to execute commands on remote systems. In several instances, SafePay threat actors used ShareFinder.ps1 —a PowerShell script function used for enumerating network file shares in Windows Active Directory environments—to identify valuable assets for exfiltration [ T1059.001 , T1059.003 ]. Additionally, SafePay threat actors used SharpShares.exe , a tool used to identify and enumerate network file shares. As SafePay threat actors prepare for lateral movement, they commonly disable security software [ T1685 ] to avoid detection. In some cases, the threat actors changed the passwords of system users, making valid logins impossible. SafePay threat actors have also been observed using software packing or virtual machine software protection to conceal their code [ T1027.002 ]. Privilege Escalation The authoring agencies observed SafePay threat actors using a User Account Control (UAC) Bypass Privilege Escalation technique [ T1548.002 ] that creates an elevated process through a specified component object model, enabling the execution of malicious commands or binaries [ T1059 ]. SafePay threat actors have also been observed using token impersonation methods [ T1134.001 ]. Lateral Movement To pivot laterally through a network and identify files for exfiltration [ TA0010 ] and encryption, SafePay threat actors use legitimate tools like PsExec, WinRM, and Remote Management and Monitoring [ T1569.002 ] software. They also employ Remote Desktop Protocol (RDP) [ T1021.001 , T1133 ] to expand their presence within the compromised network [ T1021 ]. As SafePay threat actors move laterally through a network, they look for credentials to gain admin access and will create accounts, if needed. Collection, Exfiltration, and Impact SafePay threat actors use legitimate tools, such as FileZilla, 7-Zip, RClone, and WinRAR to compress files and collect data [ T1560.001 ], and WinSCP and RClone to facilitate the exfiltration of data [ T1048 ] from the compromised network to actor-controlled accounts. In some instances, SafePay threat actors use OneDrive to exfiltrate data [ T1567 ]. In other instances, the SafePay threat actors installed legitimate remote desktop tools like AnyDesk or TeamViewer on the victim’s systems. SafePay threat actors use these tools to transfer ransomware and other software onto a victim’s system. Additionally, SafePay threat actors halt the Volume Shadow Copy Service and reset Network Attached Storage containing victim backup data to initial factory settings to inhibit system recovery attempts [ T1490 ]. Following exfiltration, SafePay threat actors encrypt files [ T1486 ] using a sophisticated hybrid encryption scheme to lock data. This involves combining a ChaCha20 stream cipher with an RSA public-key cryptosystem for a fast and secure key exchange. This multilayered approach customizes encryption methods based on file type and size and enables full or partial encryption. Data encrypted with the SafePay ransomware variant (appended with .SafePay ) cannot be recovered without the decryption key. SafePay threat actors hold the encrypted data for ransom and typically demand a subset of company revenue in cryptocurrency in exchange for decryption software. SafePay threat actors leave a ransom note on the victim’s system, typically on the desktop or root directory, advising them that SafePay locked their system and to reach out over a chat portal at a TOR .onion website link with a victim ID as the login. To put pressure on the victim, a representative makes phone calls on behalf of the ransomware group. If the victim does not pay, SafePay posts the exfiltrated data to their SafePay leak website, which is linked in the ransom note. Following encryption, SafePay may delete itself from the victim’s filesystem [ T1070.004 ]. Leveraged Tools Table 1 lists publicly available tools and applications used by SafePay threat actors, including legitimate tools repurposed for their operations. Note: These tools and applications should not be attributed as malicious without analytical evidence to support threat actor use and/or control. Table 1. Tools Leveraged by SafePay Threat Actors Tool Name Description 7-Zip An open source software that enables users to compress various file formats. SafePay threat actors maliciously use 7-Zip for data packaging and movement. FileZilla An open source client that enables users to transfer files between servers. SafePay threat actors use FileZilla maliciously for data exfiltration. Mimikatz A credential dumper that enables users to view and save authentication credentials, such as Kerberos tickets [ T1550.002 ]. SafePay threat actors use Mimikatz for password exfiltration. PowerShell A cross-platform task automation solution used for various malicious activities, including command execution. It is composed of a command-line shell, a scripting language, and a configuration management framework—which runs on Windows, Linux, and macOS. PsExec A tool designed to run programs that SafePay threat actors use to execute commands on remote systems. RClone A legitimate command-line program used to sync files with cloud storage services, such as Mega. SafePay threat actors maliciously use RClone for data packaging and movement. ScreenConnect A remote support, access, and meeting software that allows users to control devices remotely over the internet. SafePay threat actors use ScreenConnect for persistence and access. ShareFinder.ps1 A PowerShell script used to scan an Active Directory network for shared folders. SafePay threat actors use ShareFinder.ps1 for exfiltration hunting. WinRAR Archive utility used to split compromised data into segments and to compress [ T1560.001 ] files into a .RAR format prior to exfiltration. SafePay threat actors use WinRAR for data packaging and movement. WinRM A Windows-based protocol designed to facilitate remote management and automation. SafePay threat actors use WinRM for command execution. AnyDesk and TeamViewer Legitimate remote desktop tool used for accessing and controlling computers over the internet. SafePay threat actors use AnyDesk and TeamViewer to transfer malware to the victim’s system. AcronisDiskDirector A legitimate disk management tool. SharpShares.exe A network scanning tool used for host discovery and enumeration. NetExec A legitimate network assessment tool to enumerate systems, validate credentials, and manage remote operations across private networks. Backblaze A command-line tool for file management within Backblaze B2 cloud storage. SafePay threat actors executed commands via b2.exe to exfiltrate a victim’s data. Indicators of Compromise Table 2 through Table 5 list IOCs associated with SafePay ransomware that allowed for the identification of malicious activity. Disclaimer: The authoring agencies recommend organizations investigate or verify IP addresses prior to taking action, such as blocking. These IOCs were observed between November 2024 and August 2026. Table 2. IP Addresses IP Address Description 104.26.2[.]223 SafePay victim intrusion 140.82.114[.]4 SafePay victim intrusion 185.199.108[.]133 SafePay victim intrusion 77.37.49[.]40 SafePay victim intrusion 173.194.194[.]94 Hosting victim data 167.235.225[.]149 Client login panels 5.255.11[.]134 Used in exfiltration 88.119.167[.]239 soc.dll command and control 37.10.71[.]188 Used in exfiltration Note: Some of these files are legitimate tools. The authoring organizations recommend organizations investigate or verify tool use prior to taking action, such as blocking. Table 3. Malicious Files Filename Description 1 - Copy.bat A batch script likely used to copy, stage, or move files during lateral movement or data collection. CCleaner.exe/ CCleaner64.exe A legitimate system utility; however, it is suspicious if deployed in enterprise environments for file cleanup or anti-forensics. CCleaner*.exe / *.dll A file used for potential masquerading or abuse of CCleaner components for execution or persistence. dcsync.exe A tool used to perform DCSync operations to extract Active Directory credentials; high-confidence credential theft activity. domains.txt An output file likely containing enumerated domain information. DYRasWtb.exe A suspected malicious executable. libsmb2.dll A library associated with Server Message Block (SMB) communication; may support lateral movement or file transfer. Libwa*.dll A suspicious library set; likely part of a custom toolset or malware framework; requires further analysis. License.txt A benign file that may accompany tool packages or be used for masquerading. In one instance, it accompanied the tool “S.P_Network Scanner.” locker.dll A potential ransomware or encryption-related component. netscan.exe A network scanning tool used for host discovery and enumeration. netscan.lic / netscan.xml Output or configuration files associated with network scanning activity. netscanNEW.zip Archive file potentially used to stage or transfer scanning tools. nltest.exe Legitimate Windows tool used for domain trust enumeration; suspicious when used outside admin workflows. oui.txt A MAC address vendor lookup output—network reconnaissance artifact. ping.txt An output file from network connectivity testing. portable.dat A potential configuration or staging file (context-dependent). scan.xml An output file from scanning/enumeration tools. sharefinder.ps1 A PowerShell script used to enumerate network shares (reconnaissance). Socks.exe A tool used to establish SOCKS proxy for tunneling traffic. Socks_werfault.exe A binary likely masquerading to blend with Windows processes. subs.txt A possible staging file or list of targets/data for exfiltration. svchost.exe A legitimate Windows process; suspicious if located outside System32 or used for masquerading. wa_3rd_party_host_*.exe A file of suspicious binaries—likely part of SafePay threat actor toolset or masquerading components. winrar.exe A legitimate archiving tool frequently used for data staging prior to exfiltration. AnyDesk.exe A legitimate remote desktop tool for accessing and controlling computers over the internet; most of the time it is used to transfer malware to a victim’s system. SharpShares.exe A network scanning tool used for host discovery and enumeration. AcronisDiskDirector-12.5 / acro.exe / DiskDirector.exe / Acronis.exe A legitimate disk management tool. b2.exe A command-line tool for data exfiltration to Backblaze B2 cloud storage. nxc.exe The executable for NetExec, a legitimate network assessment tool used to enumerate systems, validate credentials, and manage remote operations across private networks. Table 4. SHA-1 Hash Values Hash File/Description 07353237350c35d6dc2c8f143b649cd07c71f62b 1.exe (ransomware binary) b498a2683640c983bb069fa2ea9e67cef4a3797d Locker.dll PE32 executable BBFED53E3BB1F306F4DA97D995CF4AE5B73AD081 locker.dll d711a5af5aed48a3b36b98f4fcf52809aebef7a2 nxc Table 5. SHA-256 Hash Files Hash File/Description 921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae soc.dll 6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a RunPE bundled DLL e79608cf1d6b51324c14bef8883054c1238ed5f080222cc464810e6e14adc346 Injected PE 327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917 locker.dll PE32 executable a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526 locker.dll BBDD3620A67AEDEC4B9A68B2C9CC880B6631215E129816AEA19902A6F4BC6F41 SharpShares.exe The following are IOC hostnames: WIN-SBOE3CPNAL WIN-3IUUOFVTQAR WIN-DK18BI83M0S WIN-I1HRRJHCEIV MITRE ATT&CK Tactics and Techniques See Table 6 through Table 16 for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool . Table 6. Initial Access Technique Title ID Use External Remote Services T1133 SafePay threat actors use external remote services, such as VPNs or other tools, to externally connect to an internal network. Exploit Public-Facing Application T1190 SafePay threat actors attempt to exploit a vulnerability within a system to gain access. Common vulnerabilities include software bugs, glitches, or misconfigurations. Table 7. Execution Technique Title ID Use Command and Scripting Interpreter: PowerShell T1059.001 SafePay threat actors use PowerShell, an interactive command-line interface and scripting environment contained within Windows, to identify code within a targeted network. Command and Scripting Interpreter: Windows Command Shell T1059.003 SafePay threat actors use the Windows command shell prompt to gain control of a component on a system that requires specific permissions depending on the command executed. System Services: Service Execution T1569.002 SafePay threat actors use tools, such as PsExec, to execute commands on remote systems. Command and Scripting Interpreter T1059 SafePay threat actors use Windows UAC to elevate a program’s privileges, enabling the execution of malicious commands or binaries. Table 8. Persistence Technique Title ID Use Account Manipulation T1098 SafePay threat actors establish persistence by gaining administrative privileges on existing accounts. Table 9. Privilege Escalation Technique Title ID Use Abuse Elevation Control Mechanism: Bypass User Account Control T1548.002 SafePay threat actors use Windows UAC to elevate a program’s privileges and execute a task on an administrator-level permission scale. Table 10. Stealth Technique Title ID Use Obfuscated Files or Information: Software Packing T1027.002 SafePay threat actors use software packing to conceal malicious code by means of encrypting an executable to avoid detection. Indicator Removal: File Deletion T1070.004 SafePay threat actors delete files associated with the intrusion activity to minimize their digital footprint and obfuscate malicious activities. System Binary Proxy Execution T1218 SafePay threat actors proxy the execution of malicious content with a trusted binary, often a Microsoft-signed file, to bypass signature-based network defenses. Table 11. Defense Impairment Technique Title ID Use Disable or Modify Tools T1685 SafePay threat actors disable security features, modify or delete registry keys or configuration files to impair functionality, and disable updates such as security patches on a system or network. Table 12. Credential Access Technique Title ID Use Brute Force T1110 SafePay threat actors gain access to accounts by implementing brute force password attacks. Table 13. Lateral Movement Technique Title ID Use Remote Services: Remote Desktop Protocol T1021.001 SafePay threat actors gain access to a valid account using RDP and typically disable cybersecurity features, such as Windows Defender, while using LOLBins. Remote Services: SMB/Windows Admin Shares T1021.002 SafePay threat actors gain access to a valid account using SMB to enable lateral movement throughout a network. Remote Services T1021 SafePay threat actors employ remote services to expand their presence within the compromised network. Remote Services: Windows Remote Management T1021.006 SafePay threat actors use tools, such as WinRM, to execute commands on remote systems. Table 14. Collection Technique Title ID Use Archive Collected Data: Archive via Utility T1560.001 SafePay threat actors use utilities to compress or encrypt collected data prior to exfiltration to change the format of the data to one compatible for transportation. Archive Collected Data: Archive via Library T1560.002 SafePay threat actors use credential dumpers, such as Mimikatz, for password exfiltration. Table 15. Exfiltration Technique Title ID Use Exfiltration Over Alternative Protocol T1048 SafePay threat actors exfiltrate data over an alternative protocol, including file transfer protocol, simple mail transfer protocol, HTTP/S, domain name system, SMB, or another network protocol variation that is not the main or current command and control channel. Exfiltration Over Web Service T1567 SafePay threat actors exfiltrate data over web services, such as OneDrive. Table 16. Impact Technique Title ID Use Data Encrypted for Impact T1486 SafePay threat actors encrypt data on targeted systems to disrupt access to a particular system or network service. They then demand a ransom payment in exchange for a decryption key. Inhibit System Recovery T1490 SafePay threat actors disable services designed to assist in recovery of a corrupted system. In some cases, SafePay threat actors deleted all network-attached backups of company data. Incident Response If a potential compromise is detected, but ransomware actors have not (yet) encrypted items, organizations should take the following actions: Determine which hosts were compromised and isolate them by quarantining or taking them offline. Initiate threat hunting activities to scope the intrusion . Collect and review relevant artifacts, logs, and other data to identify threat actor TTPs, compromised devices and accounts, a timeline of activity, etc. Report the suspected compromise to the FBI and other agencies as appropriate (if located within the U.K., report the compromise to Report Fraud or local police force ) (see the Reporting section for contact information). Apply eviction countermeasures , including those listed below, to contain the incident and eradicate the threat actor from the network ( Note: Start applying countermeasures after collecting enough threat hunting data to inform effective countermeasure selection; this will likely overlap with threat hunting activities). Use CISA’s Eviction Strategies Tool to assemble countermeasures for a systematic eviction plan—the tool comprises Playbook-NG (a web application) and COUN7ER (a database of post-compromise countermeasures mapped to adversary TTPs). Use Playbook-NG and COUN7ER together to assemble a systematic eviction plan, or playbook, that leverages distinct countermeasures to contain and evict cyber threat actors. The playbook features a list of recommended response actions based on threat actor TTPs and includes each action’s intended outcome, preparatory steps, and associated risks. For more information, see CISA’s Eviction Strategies Tool fact sheet. Harden the network to prevent additional malicious activity (see Mitigations for guidance). If compromise is detected and items have been encrypted, see the “Ransomware and Data Extortion Response Checklist” in CISA’s joint #StopRansomware Guide . Mitigations The authoring agencies recommend organizations implement the mitigations below to improve their cybersecurity posture on the basis of the threat actors’ activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections. Organizations should implement the following mitigations: Prioritize remediating known exploited vulnerabilities (KEVs) and keep all operating systems, software, and firmware up to date , as timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to cybersecurity threats; specifically, prioritize patching KEVs in internet-facing systems. [ CPG 2.B ]. Additionally, using Binding Operational Directive 26-04 offers a framework for patch prioritization based on technology type and steps for forensics triage. Under its implementation guidance, it offers guidance and steps to perform forensic triage for severe vulnerability cases. Implement identity, credential, and access management (ICAM) policies across the organization and require MFA for all services to the greatest extent possible—particularly for webmail, VPNs, and accounts that access critical systems [ CPG 3.F ]. Require all accounts with password logins (e.g., service accounts, admin accounts, and domain admin accounts) to comply with NIST’s digital identity guidelines ; require employees to use long passwords and consider not requiring recurring password changes, as these can weaken security [ CPG 3.B ]. Use longer passwords consisting of at least 15 characters and no more than 64 characters in length. Store passwords in a hashed format using industry-recognized password managers. Add password user “salts” to shared login credentials. Avoid reusing passwords [ CPG 3.C ]. Implement multiple failed login attempt account lockouts [ CPG 3.E ]. Disable password “hints.” Refrain from requiring password changes more frequently than once per year. Note: NIST guidance suggests favoring longer passwords instead of requiring frequent password resets. Frequent password resets are more likely to result in users developing password patterns cyber threat actors can easily decipher. Maintain offline backups of data and regularly test and maintain backup and restoration processes [ CPG 3.O ]; implementing this practice helps organizations avoid severe operational interruptions and prevents scenarios in which data is irretrievable. Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted), and covers the entire organization’s data infrastructure [ CPG 3.K ]. Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, and secure location (e.g., hard drives, storage devices, or the cloud) [ CPG 3.I , 3.O , 1.C ]. Segment networks to prevent the spread of ransomware, as network segmentation can help control traffic flows between, and access to, various subnetworks and restrict adversary lateral movement [ CPG 3.I ]. Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware with a network monitoring tool [ CPG 4.B ]. To aid in detecting ransomware, implement a tool that logs and reports all network traffic, including lateral movement activity on a network. Endpoint Detection and Response (EDR) tools are particularly useful for detecting lateral connections as they have insight into common and uncommon network connections for each host. Filter network traffic by preventing unknown or untrusted origins from accessing remote services on internal systems—this prevents threat actors from directly connecting to remote access services that they have established for persistence. Review domain controllers, servers, workstations, and Active Directories for new, unactive and/or unrecognized accounts. Disable unused ports . Consider adding an email banner to emails received from outside of your organization. Audit user accounts with administrative privileges and configure access controls according to the principle of least privilege [ CPG 3.G ]. Implement time-based access for accounts set at the admin level and higher ; for example, the Just-in-Time (JIT) access method provisions privileged access when needed and can support enforcement of the principle of least privilege (as well as the Zero Trust Maturity Model ). This is a process where a network-wide policy is set in place to automatically disable admin accounts at the Active Directory level when the account is not in direct need. Individual users may submit their requests through an automated process that grants them access to a specified system for a set timeframe when they need to support the completion of a certain task. Disable command-line and scripting activities and permissions, since privilege escalation and lateral movement often depend on software utilities running from the command line; if threat actors cannot run these tools, they will have difficulty escalating privileges and moving laterally [ CPG 3.M ]. These mitigations align with principles provided in the joint guide Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software . CISA urges software manufacturers to take ownership of improving the security outcomes of their customers by applying these and other secure by design tactics. By implementing secure by design tactics, software manufacturers can make their product lines secure “out of the box” without requiring customers to make additional configuration changes, purchasing product security add-in software and logs, monitoring, and making frequent security updates. Validate Security Controls In addition to applying mitigations, the authoring agencies recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory. To get started: Select an ATT&CK technique described in this advisory (see Table 6 to Table 16 ). Align your security technologies against the technique. Test your technologies against the technique. Analyze your detection and prevention technologies’ performance. Repeat the process for all security technologies to obtain a set of comprehensive performance data. Tune your security program, including people, processes, and technologies, based on the data generated by this process. The authoring agencies recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory. Resources Stopransomware.gov is a whole-of-government approach that provides one central location for ransomware resources and alerts. CISA’s #StopRansomware Guide provides organizations with comprehensive best practices to mitigate the risk of ransomware attacks. CISA’s Known Exploited Vulnerabilities Catalog is an authoritative resource for organizations to support improvement of their patch management best practices. CISA’s Multifactor Authentication webpage provides best practices for network defenders to mitigate threats to accounts and systems that use MFA. CISA’s Cyber Hygiene Services help organizations reduce the risk of a successful cyberattack. USSS’s Preparing for a Cyber Incident outlines basic steps an organization can take before, during, and after a cyber incident. CISA’s Cyber Security Evaluation Tool (CSET) provides a systematic, disciplined, and repeatable approach for evaluating an organization’s security posture; see Downloading and Installing CSET for step-by-step guidance to help your organization evaluate cybersecurity practices on your networks. CISA’s Ransomware Risk Assessment helps assess an organization’s ability to counteract a ransomware infection. Department of Health and Human Services’ Cybersecurity Performance Goals is a resource to help healthcare organizations implement high-impact cybersecurity practices. CISA’s Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk and its implementation guidance CISA’s CI Fortify: Strengthening Resilience Across Critical Infrastructure CISA’s Eviction Strategies Tool enables incident response teams to quickly turn observed behaviors into remediation plans U.K.’s National Cyber Security Centre U.K.’s National Crime Agency Reporting Your organization has no obligation to respond or provide information to the FBI and other authoring agencies in response to this joint advisory. If, after reviewing the information provided, your organization decides to provide information to the FBI or other authoring agencies, reporting must be consistent with applicable state and federal laws. The FBI and other authoring agencies are interested in any information, to include boundary logs showing communication to and from foreign IP addresses, a sample ransom note, communications with threat actors, Bitcoin wallet information, decryptor files, and/or a benign sample of an encrypted file. Additional details of interest include a targeted company point of contact, status and scope of infection, estimated loss, operational impact, transaction IDs, date of infection, date detected, initial attack vector, and host- and network-based indicators. The authoring agencies do not encourage paying ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, the FBI and CISA urge you to promptly report ransomware incidents to the FBI’s Internet Crime Complaint Center (IC3) , a local FBI field office , a local USSS Field Office , or CISA via the agency’s Incident Reporting System or its 24/7 Operations Center ( [email protected] ) or by calling 1-844-Say-CISA (1-844-729-2472). In the U.K., report incidents of a cybercrime or fraud at the UK’s Home for Reporting Cyber Crime & Fraud or 0300-123-2040, your local police force , or use the non-emergency number 101. Disclaimer The information in this report is being provided “as is” for informational purposes only. CISA and the FBI/USSS do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by the FBI, CISA, or USSS. The authoring agencies recognize that infrastructure used for malicious activity may be hosted on cloud or virtualized platforms where IP addresses can be dynamically or temporarily assigned. As a result, an address associated with malicious activity at one point in time may later be reassigned to benign services. Accordingly, these indicators should be interpreted as historically observed infrastructure within the activity window and should be corroborated with current network telemetry or additional intelligence sources when used for defensive or investigative purposes. Version History October 20, 2026 : Initial version.

Fix: Review CISA guidance and apply vendor security updates immediately.
Cybersecurity Advisory
Advisory
1 ... 34 35 36 37 38 ... 242
Notification