Loading story…
CISA published an ICS advisory for CVE-2025-14988, a critical (CVSS 9.8) vulnerability in iba Systems ibaPDA 8.12.0 that could allow an unauthenticated attacker to perform unauthorized actions on the underlying file system under certain conditions. The issue is categorized as CWE-732 (Incorrect Permission Assignment for Critical Resource) and may impact the confidentiality, integrity, and availability of affected OT environments; CISA notes deployment in critical manufacturing and that Siemens reported the vulnerability.
Reporting on the advisory emphasized that ibaPDA is commonly used for industrial data acquisition and process monitoring, making file-system tampering a high-impact risk (e.g., data corruption, theft, or disruption). iba Systems recommends updating to ibaPDA v8.12.1 or later; where immediate patching is not feasible, mitigations focus on hardening access (e.g., enabling/locking down user management and restricting network exposure) and following standard ICS defensive practices such as segmentation, minimizing internet exposure, and using secure remote access methods (e.g., VPNs).
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
iba Systems recommended customers upgrade to ibaPDA 8.12.1 or later to remediate CVE-2025-14988. It also advised interim hardening measures including enabling user management, restricting network access, and manually managing Windows Firewall rules.
CISA released ICS advisory ICSA-26-027-01 describing the critical ibaPDA vulnerability, noting Siemens reported the issue and that no known public exploitation was observed at publication. The advisory recommended standard ICS mitigations such as network isolation and secure remote access.
A critical improper permission vulnerability, tracked as CVE-2025-14988, was identified in ibaPDA 8.12.0. The flaw could allow unauthorized actions on the file system and impact confidentiality, integrity, and availability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT@VDE disclosed **CVE-2026-8024**, a critical deserialization flaw in iba's industrial data acquisition and automation products **ibaPDA** and **ibaDatCoordinator** that allows remote, unauthenticated code execution without user interaction. The bug is caused by unsafe use of the .NET `BinaryFormatter` to deserialize client-server input, a weakness tracked as **CWE-502**. The vulnerability carries critical severity ratings, including **CVSS v3.1 9.8** and **CVSS v4.0 9.3**, and could let an attacker gain full system access or escalate privileges because malicious code may run under the affected service account. Affected versions are **ibaPDA before 8.14.0** and **ibaDatCoordinator before 4.0.7**, and patched releases are available. The issue was reported by Tenable researchers and coordinated through CERT@VDE, with no confirmed exploitation reported at publication time. Defenders are urged to apply vendor patches immediately and, if upgrades must be delayed, reduce exposure by restricting connections to localhost, tightening Windows Firewall rules, keeping the services off untrusted networks, and validating or otherwise preventing deserialization of untrusted data.
Jul 12, 2026
CISA published four new advisories detailing critical vulnerabilities affecting a range of industrial control system (ICS) products from Advantech, Ubia, and ABB. The vulnerabilities include improper input neutralization, path traversal, use of hard-coded credentials, insufficiently protected credentials, and improper validation of input types. Exploitation of these flaws could allow attackers to achieve remote code execution, denial-of-service, unauthorized access to camera feeds, or full remote control of affected devices. The impacted products are Advantech DeviceOn/iEdge (v2.0.2 and prior), Ubia Ubox (v1.1.124), and multiple ABB FLXeon controller models (various versions up to 9.3.5). CISA recommends immediate review of the technical details and implementation of mitigations provided in the advisories. Notably, the Ubia Ubox vulnerability remains uncoordinated with the vendor, increasing risk for users. Organizations using these ICS products should prioritize patching, restrict network exposure, and follow CISA's defensive measures to minimize exploitation risk. The advisories underscore the ongoing threat to critical infrastructure posed by vulnerabilities in widely deployed ICS equipment.
Jun 29, 2026
The Canadian Centre for Cyber Security issued multiple advisories summarizing vendor and CISA disclosures from Feb 9–15, urging organizations to patch widely used platforms. This included **Linux kernel** fixes across supported Ubuntu releases (16.04 through 25.10) and a broad set of **Dell** and **IBM** product updates affecting backup/DR, infrastructure, and automation/transaction systems (e.g., *Dell Avamar/NetWorker/PowerEdge/IDPA/iDRAC Service Module* and *IBM Business Automation Workflow, Operational Decision Manager, Sterling components, webMethods Integration*, and others). CISA also published ICS advisories covering several industrial products with potentially high-impact outcomes. **Siemens Simcenter Femap and Nastran** were reported vulnerable to multiple `NDB`/`XDB` file-parsing issues (CVE-2026-23715 through CVE-2026-23720) that can be triggered via malicious files and may lead to crashes or **arbitrary code execution** (CVSS 7.8), with Siemens recommending upgrades. **GE Vernova Enervista UR Setup** versions `< 8.70` were reported vulnerable to **DLL hijacking** and **path traversal** (CVE-2026-1762, CVE-2026-1763; CVSS 7.8), potentially enabling elevated code execution. Separately, CISA advisory `ICSA-26-043-10` described a **critical** unauthenticated **remote code execution** risk in **Airleader Master** `<= 6.381` due to an unrestricted file upload flaw (CVE-2026-1358; CVSS 9.8); CISA noted no known public exploits at the time and recommended exposure reduction measures such as network segmentation and restricting internet access to control systems.
Jun 29, 2026