Loading story…
CERT@VDE disclosed CVE-2026-8024, a critical deserialization flaw in iba's industrial data acquisition and automation products ibaPDA and ibaDatCoordinator that allows remote, unauthenticated code execution without user interaction. The bug is caused by unsafe use of the .NET BinaryFormatter to deserialize client-server input, a weakness tracked as CWE-502. The vulnerability carries critical severity ratings, including CVSS v3.1 9.8 and CVSS v4.0 9.3, and could let an attacker gain full system access or escalate privileges because malicious code may run under the affected service account.
Affected versions are ibaPDA before 8.14.0 and ibaDatCoordinator before 4.0.7, and patched releases are available. The issue was reported by Tenable researchers and coordinated through CERT@VDE, with no confirmed exploitation reported at publication time. Defenders are urged to apply vendor patches immediately and, if upgrades must be delayed, reduce exposure by restricting connections to localhost, tightening Windows Firewall rules, keeping the services off untrusted networks, and validating or otherwise preventing deserialization of untrusted data.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Patched versions were made available for the affected products, with ibaPDA fixed in version 8.14.0 and ibaDatCoordinator fixed in version 4.0.7. The references do not specify the exact release date of these patches.
Security Online states that Tenable researchers reported the unsafe .NET BinaryFormatter deserialization issue affecting ibaPDA and ibaDatCoordinator, and that CERT@VDE coordinated the disclosure process. The source does not provide a specific date for when the report was made.
CERT@VDE disclosed CVE-2026-8024 as a critical remote unauthenticated deserialization vulnerability in ibaPDA and ibaDatCoordinator. The flaw can allow arbitrary code execution and potential full system compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecvefeed.io
Open sourcecertvde.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CISA** published an ICS advisory for **CVE-2025-14988**, a **critical (CVSS 9.8)** vulnerability in **iba Systems ibaPDA 8.12.0** that could allow an unauthenticated attacker to perform **unauthorized actions on the underlying file system** under certain conditions. The issue is categorized as **CWE-732 (Incorrect Permission Assignment for Critical Resource)** and may impact the **confidentiality, integrity, and availability** of affected OT environments; CISA notes deployment in **critical manufacturing** and that **Siemens** reported the vulnerability. Reporting on the advisory emphasized that ibaPDA is commonly used for industrial data acquisition and process monitoring, making file-system tampering a high-impact risk (e.g., data corruption, theft, or disruption). **iba Systems** recommends updating to **ibaPDA v8.12.1 or later**; where immediate patching is not feasible, mitigations focus on hardening access (e.g., enabling/locking down user management and restricting network exposure) and following standard ICS defensive practices such as segmentation, minimizing internet exposure, and using secure remote access methods (e.g., VPNs).
Jun 29, 2026
AVEVA disclosed a critical deserialization of untrusted data vulnerability in **Enterprise SCADA** tracked as `CVE-2025-7639`, a remotely exploitable flaw with a **CVSS 4.0 score of 10.0**. The issue allows an authenticated attacker holding the **"DNA Authority - Operator"** privilege to tamper with serialized data and potentially trigger code execution during deserialization under the privileges of the **"DNA Apps"** security group. The vendor addressed the issue in security bulletin **`AVEVA-2026-005`** and advised organizations to apply available patches and hardening measures. Recommended mitigations include restricting operator privileges and validating serialized data inputs, as the flaw affects industrial control and supervisory environments where compromise of SCADA application privileges could materially increase operational risk.
Aug 14, 2026
IBM disclosed two vulnerabilities in traditional **IBM WebSphere Application Server** affecting versions **9.0** and **8.5**, led by **CVE-2026-14512**, a **pre-authentication unsafe deserialization** flaw rated **CVSS 9.8**. The issue could allow a remote attacker to **bypass authentication** or achieve **arbitrary code execution** without user interaction, creating a high-risk path to full compromise of exposed WebSphere environments. IBM also identified **CVE-2026-14528**, a **CVSS 7.4** flaw that could expose sensitive information through insertion into log files. The company directed customers to apply the interim fix for **APAR PH72166** or upgrade to **Fix Pack 9.0.5.29+** for WebSphere 9.0 and **Fix Pack 8.5.5.31+** for WebSphere 8.5, and said **no workarounds or mitigations are available**.
Jul 29, 2026