Loading story…
Rockwell Automation, Siemens, and Schneider Electric issued July industrial security advisories covering dozens of OT vulnerabilities, with Rockwell disclosing multiple high-impact flaws in control and I/O products. The most severe Rockwell issue, CVE-2026-10577, affects 1715 Redundant IO and exposes a network-accessible debug port without authentication, allowing remote attackers to run intrusive CLI commands, read or delete files, stop tasks, modify memory, and change I/O states; the flaw carries a CVSS v4.0 score of 10.0. Rockwell also reported CVE-2026-9636, a CIP Security certificate revocation handling weakness in several CompactLogix 5380, ControlLogix 5580, GuardLogix 5580, and 1756-EN4 devices that could let a network attacker connect with a certificate that should no longer be trusted, and CVE-2025-11698, a buffer overflow in Logix controller recovery images that can trigger a major non-recoverable fault and cause denial of service.
Separately, CERT VDE published VDE-2026-031 for CVE-2026-4769, a critical WAGO System I/O Field vulnerability caused by an undocumented internal diagnostic function exposed without authentication during early boot. An unauthenticated remote attacker can exploit the startup window to access internal system processes and fully compromise affected 0765-series devices; the issue is rated CVSS 3.1 9.8 and CVSS 4.0 9.3. Siemens also disclosed CVE-2025-40945, an untrusted search path flaw in the IAM Client SDK used across products including COMOS, Designcenter NX, Simcenter, Solid Edge, Teamcenter Visualization, and Tecnomatix, enabling local privilege escalation for authenticated users and reinforcing the breadth of current patching demands across industrial environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
SecurityWeek reported that Siemens, Schneider Electric, and Rockwell Automation released July 2026 Patch Tuesday advisories covering dozens of ICS and OT vulnerabilities. The report highlights nine Siemens advisories, two Schneider advisories, and 12 Rockwell advisories, including critical flaws in Opencenter X and 1715 Redundant IO.
Rockwell Automation disclosed CVE-2025-11698, a buffer overflow affecting 5380/5480/5580 controller recovery image boot firmware before version 1.072. The flaw could let a malicious user write invalid file data and force a controller into a major non-recoverable fault.
Rockwell Automation disclosed CVE-2026-10577, a critical access control vulnerability in 1715 Redundant IO that exposes a network-accessible debug port without proper privilege controls. An unauthenticated remote attacker could use intrusive CLI commands to alter files, memory, tasks, and I/O states.
Siemens disclosed CVE-2025-40945, an untrusted search path flaw in the IAM Client SDK affecting multiple engineering and industrial software products. The issue may allow a locally authenticated user to escalate privileges, and Siemens identified fixed versions and recommended updates.
The CVE record for CVE-2026-9636 was updated to describe improper certificate revocation handling in several Rockwell Automation Logix and 1756-EN4 devices. The issue could allow a network attacker to connect using a certificate that should no longer be trusted.
CERT VDE published advisory VDE-2026-031 for CVE-2026-4769, a critical unauthenticated access vulnerability affecting certain WAGO System I/O Field devices during early boot. The flaw can expose an internal diagnostic interface and enable full system compromise.
Rockwell Automation published a security advisories reference page covering product security notices for its portfolio. The provided reference anchors the page publication date but does not enumerate a specific advisory event on that date.
ABB's advisory index documents cybersecurity alerts and notifications spanning 2012 through 2024 for ABB and B&R industrial products, including vulnerability disclosures and ecosystem-wide threat notices. The reference describes this as an archived advisory collection rather than a single incident.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcesecurityonline.info
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcerockwellautomation.com
Open sourceabb.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA republished multiple Rockwell Automation advisories covering vulnerabilities across **FactoryTalk Analytics PavilionX**, **RSLinx Classic**, **CompactLogix 5370**, **Logix 5370/5570 controllers**, and **FLEX I/O EtherNet/IP Adapters** used in critical manufacturing environments worldwide. The issues include an authorization bypass in PavilionX (`CVE-2025-14272`) that could let an unauthenticated attacker perform privileged administrative actions, and a third-party flaw in RSLinx Classic (`CVE-2020-13573`) tied to out-of-bounds read and stack-based buffer overflow conditions that could cause denial of service or enable remote arbitrary code execution. Additional advisories detail multiple **CIP-related denial-of-service weaknesses** in CompactLogix and Logix controllers, including `CVE-2026-11317`, where crafted CIP messages can trigger major nonrecoverable faults requiring a program download, as well as sequence-number, source-IP, and connection-ID issues that can induce controller faults. CISA also warned that FLEX I/O EtherNet/IP Adapters version `2.012` are affected by `CVE-2026-0646`, which can fault devices through malformed CIP requests, and `CVE-2026-0647`, a critical authentication bypass in the embedded web server that allows password changes through a crafted HTTP GET request, potentially leading to account takeover and loss of availability; CISA said no known public exploitation had been reported and urged operators to isolate control networks, reduce internet exposure, and secure remote access with firewalls and updated VPNs.
Jul 12, 2026
CISA released thirteen advisories detailing critical vulnerabilities affecting a range of industrial control system (ICS) products from major vendors including Rockwell Automation, Siemens, Hitachi Energy, Schneider Electric, and Delta Electronics. The advisories highlight severe security flaws such as missing authentication for critical functions, improper authorization, buffer overflows, SQL injection, and improper certificate validation. For Siemens TeleControl Server Basic, a vulnerability (CVE-2025-40765) allows unauthenticated remote attackers to obtain password hashes and perform authenticated operations on the database service, with a CVSS v3.1 score of 9.8, indicating critical risk. Rockwell Automation's FactoryTalk View Machine Edition and PanelView Plus 7 are susceptible to path traversal and improper authorization, potentially granting attackers unauthorized access to device file systems and sensitive diagnostic information. FactoryTalk ViewPoint is vulnerable to XML external entity injection, which could result in denial-of-service conditions. Siemens SiPass Integrated faces multiple issues, including buffer overflows and cross-site scripting, which could enable arbitrary code execution and unauthorized access. The Siemens SIMATIC ET 200SP Communication Processors have a missing authentication flaw that could allow attackers to access configuration data remotely. Siemens SINEC NMS is affected by a SQL injection vulnerability that could let low-privileged users escalate privileges. Siemens Solid Edge products are exposed to out-of-bounds read and write vulnerabilities, risking application crashes or code execution. Siemens HyperLynx and Industrial Edge App Publisher are vulnerable to type confusion, potentially leading to arbitrary code execution via crafted HTML pages. Hitachi Energy MACH GWS products have incorrect default permissions and improper validation issues, which could allow attackers to tamper with system files, cause denial of service, or perform man-in-the-middle attacks. The advisories provide technical details, affected product versions, and recommended mitigations, urging administrators to review and apply patches or workarounds. The vulnerabilities impact critical infrastructure sectors such as manufacturing, energy, water, and transportation, with products deployed worldwide. Many of the flaws are remotely exploitable with low attack complexity, increasing the urgency for remediation. CISA emphasizes the importance of timely action to prevent exploitation, as several vulnerabilities could lead to unauthorized access, data manipulation, or disruption of essential services. The advisories also reference the need to consult vendor-specific security updates for the most current information. Organizations are advised to assess their exposure, prioritize patching, and implement recommended security controls to mitigate these risks. The coordinated disclosure underscores the ongoing threat to ICS environments and the necessity for robust security practices across operational technology networks.
Jun 29, 2026
CISA published ICS advisories warning that multiple **Rockwell Automation** products contain remotely triggerable vulnerabilities that can cause **denial-of-service (DoS)** conditions. In *ArmorStart LT* (models **290D/291D/294D** running **<= v2.002**), CISA lists multiple CVEs (including **CVE-2025-9464/9465/9466** and **CVE-2025-9278** through **CVE-2025-9283**) tied to **uncontrolled resource consumption** (CWE-400). The issue can be triggered during fuzzing of multiple **CIP** classes, causing the device’s CIP port to become unresponsive; CISA rates the condition **CVSS 7.5 (HIGH)**. A separate CISA advisory covers *ControlLogix* **1756-RM2** and **1756-RM2XT** Redundancy Enhanced Modules (firmware **all versions**) impacted by **CVE-2025-14027**, described as resource-exhaustion and memory-management problems (CWE-401) that can be triggered via crafted inputs such as malformed **Class 3** messages. Exploitation may render devices unresponsive and can lead to a major nonrecoverable fault requiring a restart; CISA also rates this **CVSS 7.5 (HIGH)** and notes broad deployment across multiple critical infrastructure sectors. A separate report about a **Johnson Controls Metasys** **SQL injection** vulnerability (**CVE-2025-26385**, **CVSS 10**) is a different vendor/product and is not part of the Rockwell advisories described above.
Jun 29, 2026