Multiple Critical Vulnerabilities in Eclipse Milo OPC UA Implementation

The Eclipse Foundation has disclosed multiple critical vulnerabilities affecting the Eclipse Milo OPC UA stack, specifically versions 0.6.0 through 1.1.4. These flaws span authorization logic, memory management, and configuration handling. The most severe vulnerabilities, such as CVE-2026-58080 and CVE-2026-62927, allow unauthenticated remote attackers to bypass role-based access control, invoke protected methods, or manipulate protected nodes. Other issues, such as CVE-2026-63252, facilitate remote denial-of-service (DoS) attacks via memory exhaustion in UASC server transport handlers.

These vulnerabilities pose a significant risk to industrial control systems (ICS) and critical infrastructure, including the energy, manufacturing, and water sectors. Successful exploitation can lead to unauthorized data access, credential recovery, user impersonation, and total service disruption. Defenders should prioritize migrating affected instances to Eclipse Milo 1.1.5, as no patches are available for the 0.6.x branch.

Impact

Successful exploitation of these vulnerabilities allows unauthenticated remote attackers to compromise the integrity and availability of OPC UA servers. Potential impacts include the permanent deletion of protected data, extraction of sensitive credentials and session metadata, impersonation of authorized users, and the ability to cause complete server failure (DoS). These vulnerabilities are particularly critical in industrial environments where Milo is used for communication between supervisory systems and field devices.

Recommendation

• Upgrade all deployments of Eclipse Milo to version 1.1.5 immediately, as no security updates are provided for the 0.6.x branch.
• Identify and audit all OPC UA server configurations that rely on role-based access control (RBAC), specifically checking if OpcUaServerConfig.copy() is used, as this is vulnerable to CVE-2026-58080.
• Restrict network access to OPC UA endpoints to only known, trusted client IP addresses to mitigate remote unauthenticated exploitation attempts.
• Implement monitoring for abnormal service crashes or frequent channel disconnects, which may indicate exploitation of the memory exhaustion vulnerability (CVE-2026-63252).