Loading story…
A critical vulnerability, tracked as CVE-2025-13932, has been identified in the SolisCloud Monitoring Platform's API, affecting both API v1 and API v2. The flaw is an Insecure Direct Object Reference (IDOR) that allows any authenticated user to access detailed data of any plant by simply modifying the plant_id parameter in API requests. This vulnerability is remotely exploitable with low attack complexity and has been assigned a CVSS v4 score of 8.3, indicating high severity.
The vulnerability impacts SolisCloud's cloud-based monitoring platform, which is widely deployed in the energy sector globally. Despite the disclosure, SolisCloud has not responded to mitigation requests from CISA, leaving users of affected versions at risk. The issue was reported by security researcher James Gallagher (@5G), and exploitation could result in unauthorized access to sensitive operational data across installations worldwide.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2025-13932 was publicly listed as a high-severity broken access control vulnerability in the SolisCloud API, described as an insecure direct object reference (IDOR) issue. The public CVE reference appeared later the same day.
CISA published ICS advisory ICSA-25-338-06 covering a vulnerability affecting the SolisCloud Monitoring Platform. The advisory was released on the same date the issue was publicly documented in the provided references.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA released a coordinated set of advisories detailing newly discovered vulnerabilities affecting a range of industrial control system (ICS) products from vendors including Advantech, Johnson Controls, Mitsubishi Electric, and SolisCloud. The vulnerabilities include a critical SQL injection flaw in Advantech iView (CVE-2025-13373), improper certificate expiration validation in Johnson Controls iSTAR (CVE-2025-61736), cleartext storage of sensitive information in Mitsubishi Electric GX Works2 (CVE-2025-3784), a forced browsing vulnerability in Johnson Controls OpenBlue Mobile Web Application (CVE-2025-26381), and an authorization bypass in SolisCloud Monitoring Platform (CVE-2025-13932). These flaws could allow attackers to access or modify sensitive data, disrupt communications, or gain unauthorized access to critical infrastructure systems. CISA's advisories provide technical details, affected product versions, and recommended mitigations, such as software updates and network segmentation, to reduce the risk of exploitation. The vulnerabilities impact products deployed globally across sectors such as critical manufacturing, energy, commercial facilities, and government services. Some advisories note that fixes are available, while others indicate that patches are still under development or that vendors have not responded to coordination efforts. CISA urges organizations using these products to review the advisories and implement recommended mitigations to protect against potential attacks targeting these ICS environments.
Jun 29, 2026
Two high-severity vulnerabilities affecting **OpenPLC_V3** were disclosed in CISA ICS advisory `ICSA-25-345-10`, exposing industrial control environments to unauthorized access and credential compromise. `CVE-2026-28205` is an insecure default initialization flaw (`CWE-1188`) that could allow a remote attacker to bypass authentication through an API and gain access to the system, with the CVSS v4 vector indicating network reachability, low attack complexity, and no required privileges or user interaction. A second issue, `CVE-2026-35556`, involves plaintext password storage (`CWE-256`) in OpenPLC_V3, creating a path for attackers to recover credentials and access sensitive information. The vulnerability record also carries a network-exploitable CVSS v4 profile with low attack complexity and high potential impact to confidentiality, integrity, and availability, underscoring the risk to operators using the platform in ICS environments.
Jun 29, 2026
SolarWinds released **SolarWinds Observability Self-Hosted 2026.2.3** to remediate two unauthenticated remote-code-execution flaws: **CVE-2026-28324** (CVSS 9.8) and **CVE-2026-28325** (CVSS 8.8). CVE-2026-28324 affects deployments using a non-default, non-secure configuration and stems from insufficient integrity checks (`CWE-345`); it can be exploited remotely without authentication or user interaction, with potential total compromise of confidentiality, integrity, and availability. CVE-2026-28325 arises from deserialization of untrusted data in a specific communication mode. CISA SSVC data for CVE-2026-28324 identifies exploitation as automatable and the technical impact as total, although no known active exploitation was reported. Organizations running affected self-hosted SolarWinds environments should prioritize upgrading to version 2026.2.3, especially where non-default insecure configurations or the affected communication mode are in use. The update also changes Web Performance Monitor player upgrade behavior by migrating default passive players to active mode and generating strong passwords for remotely installed passive players, alongside platform and application-monitoring defect fixes.
Sep 25, 2026