Loading story…
Schneider Electric, Siemens, Aveva, and Rockwell Automation released security advisories and patches for industrial control system and operational technology products. Schneider Electric fixed CVE-2026-3869, a CVSS 9.2 authentication vulnerability affecting Modicon M580 and M580 Safety controllers that could permit unauthorized access and complete compromise of affected systems.
Siemens issued nine advisories, four covering critical vulnerabilities, and began deploying fixes for the Linux kernel Copy Fail flaw, CVE-2026-31431, which can provide root-shell access. Aveva remediated sensitive-data exposure and password-security issues in Pipeline Integrity Monitor, while Rockwell Automation published nine advisories affecting RSLinx Classic, industrial controllers, and FactoryTalk products; organizations should prioritize applying vendor patches to exposed OT assets.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Siemens issued seven of its nine new security advisories on September 8, including advisories for critical vulnerabilities affecting products such as Reyrolle 7SR5, Open Interface Services, Industrial Edge Management, SIMOVE Fleetmanager, and SIPLANT.
Aveva issued an advisory for four PIMBoards component vulnerabilities in Pipeline Integrity Monitor. Two were high severity, including a hardcoded encryption key that could expose sensitive information and MD5-hashed passwords that could enable recovery of administrative passwords.
Siemens published nine new and updated nine existing industrial-product advisories during the September 2026 Patch Tuesday cycle. It also announced product updates for Linux kernel Copy Fail vulnerability CVE-2026-31431, which has a CVSS score of 7.8 and can enable root shell access.
During September 2026 ICS Patch Tuesday, Schneider Electric issued four new and updated four existing advisories. The updates addressed CVE-2026-3869, a CVSS 9.2 authentication vulnerability affecting Modicon M580 and M580 Safety controllers, as well as flaws in PowerLogic T300, EcoStruxure IT Data Center Expert, SCADAPack x70, and Modicon MC80 products.
CISA published vulnerability advisories since the prior Patch Tuesday for products from numerous vendors, including CareCam, Tycon Systems, Inductive Automation, Johnson Controls, Hitachi Energy, Haiwell, and others.
Rockwell Automation published nine advisories covering critical and high-severity flaws in RSLinx Classic, industrial controllers, and FactoryTalk products, including CompactLogix and GuardLogix controller families.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcemalware.news
Open sourcesecurityweek.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA released thirteen advisories detailing critical vulnerabilities affecting a range of industrial control system (ICS) products from major vendors including Rockwell Automation, Siemens, Hitachi Energy, Schneider Electric, and Delta Electronics. The advisories highlight severe security flaws such as missing authentication for critical functions, improper authorization, buffer overflows, SQL injection, and improper certificate validation. For Siemens TeleControl Server Basic, a vulnerability (CVE-2025-40765) allows unauthenticated remote attackers to obtain password hashes and perform authenticated operations on the database service, with a CVSS v3.1 score of 9.8, indicating critical risk. Rockwell Automation's FactoryTalk View Machine Edition and PanelView Plus 7 are susceptible to path traversal and improper authorization, potentially granting attackers unauthorized access to device file systems and sensitive diagnostic information. FactoryTalk ViewPoint is vulnerable to XML external entity injection, which could result in denial-of-service conditions. Siemens SiPass Integrated faces multiple issues, including buffer overflows and cross-site scripting, which could enable arbitrary code execution and unauthorized access. The Siemens SIMATIC ET 200SP Communication Processors have a missing authentication flaw that could allow attackers to access configuration data remotely. Siemens SINEC NMS is affected by a SQL injection vulnerability that could let low-privileged users escalate privileges. Siemens Solid Edge products are exposed to out-of-bounds read and write vulnerabilities, risking application crashes or code execution. Siemens HyperLynx and Industrial Edge App Publisher are vulnerable to type confusion, potentially leading to arbitrary code execution via crafted HTML pages. Hitachi Energy MACH GWS products have incorrect default permissions and improper validation issues, which could allow attackers to tamper with system files, cause denial of service, or perform man-in-the-middle attacks. The advisories provide technical details, affected product versions, and recommended mitigations, urging administrators to review and apply patches or workarounds. The vulnerabilities impact critical infrastructure sectors such as manufacturing, energy, water, and transportation, with products deployed worldwide. Many of the flaws are remotely exploitable with low attack complexity, increasing the urgency for remediation. CISA emphasizes the importance of timely action to prevent exploitation, as several vulnerabilities could lead to unauthorized access, data manipulation, or disruption of essential services. The advisories also reference the need to consult vendor-specific security updates for the most current information. Organizations are advised to assess their exposure, prioritize patching, and implement recommended security controls to mitigate these risks. The coordinated disclosure underscores the ongoing threat to ICS environments and the necessity for robust security practices across operational technology networks.
Jun 29, 2026
Siemens, Schneider Electric, Phoenix Contact, and Honeywell published security advisories for industrial control and building management products, with Siemens disclosing the most severe issues. Siemens released 10 advisories covering multiple products, including a maximum-severity missing-authentication flaw in **SIMATIC IoT2050 Advanced** that could enable remote unauthenticated code execution with elevated privileges, and a critical code-execution vulnerability in **Siveillance Video Management Servers**. Additional Siemens updates addressed 13 high-severity flaws affecting products such as **Simcenter Femap**, **Solid Edge SE2025/SE2026**, **Parasolid**, **Simcenter Nastran**, and **Siemens License Server**, where exploitation could allow arbitrary code execution or arbitrary file read.
Aug 12, 2026
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a series of advisories addressing newly discovered vulnerabilities in a wide range of industrial control systems (ICS) products. These advisories, released between October 13 and 21, 2025, cover products from major vendors such as Rockwell Automation, Siemens, Schneider Electric, Delta Electronics, Hitachi Energy, and Oxford Nanopore Technologies. The advisories provide technical details about the vulnerabilities, including affected versions, potential impacts, and recommended mitigations. For Rockwell Automation, advisories were published for products including the 1783-NATR, Compact GuardLogix 5370, 1715 EtherNet/IP, ArmorStart AOP, FactoryTalk Linx, FactoryTalk View Machine Edition, and PanelView Plus 7 Terminal, with some vulnerabilities identified by specific CVEs such as CVE-2025-9063 and CVE-2025-9064. Siemens products affected include SIMATIC S7-1200 CPU V1/V2 Devices, RUGGEDCOM ROS Devices, HyperLynx, Industrial Edge App Publisher, SIMATIC ET 200SP Communication Processors, SINEC NMS, SiPass Integrated, Solid Edge SE2024 and SE2025, and TeleControl Server Basic. Schneider Electric advisories addressed issues in Pro-Face GP-Pro EX and Remote HMI, Modicon Controllers, Advanced Reporting and Dashboards Module for EcoStruxure Power Operation, and EcoStruxure Power Monitoring Expert (PME) across several versions. Additional advisories were released for CloudEdge Online Cameras and App, Raisecomm RAX701-GC Series, and Oxford Nanopore Technologies MinKNOW. The advisories detail the nature of the vulnerabilities, which range from improper input validation to authentication bypass and remote code execution risks. CISA and the Canadian Centre for Cyber Security both urge ICS users and administrators to review the advisories, apply recommended mitigations, and update affected systems to reduce the risk of exploitation. The coordinated release of these advisories highlights the ongoing threat landscape facing critical infrastructure and the need for timely patch management. Many of the vulnerabilities could allow attackers to gain unauthorized access, disrupt operations, or compromise sensitive industrial processes. The advisories include links to technical documentation and vendor updates, enabling organizations to assess their exposure and take immediate action. The affected products are widely deployed in sectors such as manufacturing, energy, and utilities, increasing the urgency for remediation. CISA’s advisories are part of a broader effort to enhance the security posture of industrial environments against evolving cyber threats. The inclusion of both new and updated advisories for previously disclosed vulnerabilities demonstrates the dynamic nature of ICS security. Organizations are reminded to follow best practices for ICS security, including network segmentation, access control, and regular vulnerability assessments. The advisories also emphasize the importance of monitoring for signs of exploitation and maintaining up-to-date incident response plans. By addressing these vulnerabilities promptly, asset owners can help safeguard critical infrastructure from potential cyberattacks.
Jun 29, 2026