Loading story…
Siemens, Schneider Electric, Phoenix Contact, and Honeywell published security advisories for industrial control and building management products, with Siemens disclosing the most severe issues. Siemens released 10 advisories covering multiple products, including a maximum-severity missing-authentication flaw in SIMATIC IoT2050 Advanced that could enable remote unauthenticated code execution with elevated privileges, and a critical code-execution vulnerability in Siveillance Video Management Servers. Additional Siemens updates addressed 13 high-severity flaws affecting products such as Simcenter Femap, Solid Edge SE2025/SE2026, Parasolid, Simcenter Nastran, and Siemens License Server, where exploitation could allow arbitrary code execution or arbitrary file read.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
CISA published three new advisories covering Pulsetto products, Mira products from Quanovate Tech, and Johnson Controls products. These advisories were noted alongside the August 2026 ICS Patch Tuesday disclosures.
Phoenix Contact released an advisory for multiple vulnerabilities in PLCnext firmware. The flaws could allow unauthenticated attackers to cause denial of service, trigger unexpected behavior, or execute malicious SQL queries.
Schneider Electric published two new advisories covering NetBotz 5 and PowerChute Serial Shutdown. The fixes address code or command execution issues in NetBotz 5 and an excessive-authentication-attempts flaw in PowerChute Serial Shutdown that could lead to disruption or access to system data.
As part of its August 2026 ICS Patch Tuesday advisories, Siemens fixed a critical code execution vulnerability affecting Siveillance Video Management Servers. SecurityWeek identified this as one of the notable critical issues in the release.
Siemens released security updates addressing multiple vulnerabilities across products including SIMATIC IoT2050 Advanced, Simcenter Femap, Solid Edge, Parasolid, Simcenter Nastran, and Siemens License Server. The updates include one critical and multiple high-severity flaws that could enable arbitrary code execution or arbitrary file read.
Honeywell published several advisories for building management system products, as noted in the August 2026 ICS Patch Tuesday coverage. The referenced Honeywell page is a security patch testing notices page for Pro-Watch and MAXPRO software.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcesecurityweek.com
Open sourceacn.gov.it
Open sourcebuildings.honeywell.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Schneider Electric, Siemens, Aveva, and Rockwell Automation released security advisories and patches for industrial control system and operational technology products. Schneider Electric fixed **CVE-2026-3869**, a CVSS 9.2 authentication vulnerability affecting Modicon M580 and M580 Safety controllers that could permit unauthorized access and complete compromise of affected systems. Siemens issued nine advisories, four covering critical vulnerabilities, and began deploying fixes for the Linux kernel Copy Fail flaw, **CVE-2026-31431**, which can provide root-shell access. Aveva remediated sensitive-data exposure and password-security issues in Pipeline Integrity Monitor, while Rockwell Automation published nine advisories affecting RSLinx Classic, industrial controllers, and FactoryTalk products; organizations should prioritize applying vendor patches to exposed OT assets.
Sep 11, 2026
CISA released thirteen advisories detailing critical vulnerabilities affecting a range of industrial control system (ICS) products from major vendors including Rockwell Automation, Siemens, Hitachi Energy, Schneider Electric, and Delta Electronics. The advisories highlight severe security flaws such as missing authentication for critical functions, improper authorization, buffer overflows, SQL injection, and improper certificate validation. For Siemens TeleControl Server Basic, a vulnerability (CVE-2025-40765) allows unauthenticated remote attackers to obtain password hashes and perform authenticated operations on the database service, with a CVSS v3.1 score of 9.8, indicating critical risk. Rockwell Automation's FactoryTalk View Machine Edition and PanelView Plus 7 are susceptible to path traversal and improper authorization, potentially granting attackers unauthorized access to device file systems and sensitive diagnostic information. FactoryTalk ViewPoint is vulnerable to XML external entity injection, which could result in denial-of-service conditions. Siemens SiPass Integrated faces multiple issues, including buffer overflows and cross-site scripting, which could enable arbitrary code execution and unauthorized access. The Siemens SIMATIC ET 200SP Communication Processors have a missing authentication flaw that could allow attackers to access configuration data remotely. Siemens SINEC NMS is affected by a SQL injection vulnerability that could let low-privileged users escalate privileges. Siemens Solid Edge products are exposed to out-of-bounds read and write vulnerabilities, risking application crashes or code execution. Siemens HyperLynx and Industrial Edge App Publisher are vulnerable to type confusion, potentially leading to arbitrary code execution via crafted HTML pages. Hitachi Energy MACH GWS products have incorrect default permissions and improper validation issues, which could allow attackers to tamper with system files, cause denial of service, or perform man-in-the-middle attacks. The advisories provide technical details, affected product versions, and recommended mitigations, urging administrators to review and apply patches or workarounds. The vulnerabilities impact critical infrastructure sectors such as manufacturing, energy, water, and transportation, with products deployed worldwide. Many of the flaws are remotely exploitable with low attack complexity, increasing the urgency for remediation. CISA emphasizes the importance of timely action to prevent exploitation, as several vulnerabilities could lead to unauthorized access, data manipulation, or disruption of essential services. The advisories also reference the need to consult vendor-specific security updates for the most current information. Organizations are advised to assess their exposure, prioritize patching, and implement recommended security controls to mitigate these risks. The coordinated disclosure underscores the ongoing threat to ICS environments and the necessity for robust security practices across operational technology networks.
Jun 29, 2026
**Siemens published security advisories for multiple products**, prompting both CISA ICS advisories and a Canadian Centre for Cyber Security alert covering a broad set of affected industrial/engineering software and OT-adjacent components. Reported issues include a **stored XSS** in *Siemens Polarion* (CVE-2025-40587; CVSS 7.6) where authenticated users can inject JavaScript via crafted document titles, and **local privilege escalation** paths in *Siemens SINEC NMS* and its *User Management Component (UMC)* (CVE-2026-25655, CVE-2026-25656; CVSS 7.8) that allow low-privileged users to modify configuration/search paths to load malicious DLLs and potentially gain elevated execution (including SYSTEM-level impact). Siemens also addressed a **missing authorization** condition affecting *Siveillance Video Management Servers* Webhooks/MIP Webhooks API (CVSS 6.3), enabling a read-only user to obtain full API access. Additional advisories cover file-parsing and third-party component risks that can lead to crashes or potential code execution. *Siemens NX* is affected by multiple **CGM file parsing** flaws (CVE-2026-22923/22924/22925; CVSS 7.8) that can be triggered when a user opens a malicious file, and *Siemens Solid Edge* includes an **out-of-bounds read** in the PS/IGES Parasolid translator when processing crafted IGS files (CVSS 7.8). *Desigo CC* and *SENTRON Powermanager* are impacted via the third-party *WIBU Systems CodeMeter Runtime* chain tied to **CVE-2023-38545** (curl SOCKS5 heap overflow; CVSS 8.8), with Siemens providing component update instructions. *Siemens SINEC OS* before V3.3 aggregates a large set of third-party CVEs across supported platforms, and *Siemens COMOS* advisories include multiple issues (up to CVSS 10) spanning potential code execution, DoS, data exposure, and access control violations; Siemens recommends updating where fixes are available and applying countermeasures where they are not yet released.
Jun 29, 2026