{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/eclipse-milo-1.0.0-1.1.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:eclipse:milo:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-58080"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Eclipse Milo (\u003e=0.6.0, \u003c=1.1.4)","Eclipse Milo (\u003e=1.0.0, \u003c=1.1.4)"],"_cs_severities":["medium"],"_cs_tags":["ics","opc-ua","denial-of-service","broken-access-control"],"_cs_type":"advisory","_cs_vendors":["Eclipse Foundation"],"content_html":"\u003cp\u003eThe Eclipse Foundation has disclosed multiple critical vulnerabilities affecting the Eclipse Milo OPC UA stack, specifically versions 0.6.0 through 1.1.4. These flaws span authorization logic, memory management, and configuration handling. The most severe vulnerabilities, such as CVE-2026-58080 and CVE-2026-62927, allow unauthenticated remote attackers to bypass role-based access control, invoke protected methods, or manipulate protected nodes. Other issues, such as CVE-2026-63252, facilitate remote denial-of-service (DoS) attacks via memory exhaustion in UASC server transport handlers.\u003c/p\u003e\n\u003cp\u003eThese vulnerabilities pose a significant risk to industrial control systems (ICS) and critical infrastructure, including the energy, manufacturing, and water sectors. Successful exploitation can lead to unauthorized data access, credential recovery, user impersonation, and total service disruption. Defenders should prioritize migrating affected instances to Eclipse Milo 1.1.5, as no patches are available for the 0.6.x branch.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of these vulnerabilities allows unauthenticated remote attackers to compromise the integrity and availability of OPC UA servers. Potential impacts include the permanent deletion of protected data, extraction of sensitive credentials and session metadata, impersonation of authorized users, and the ability to cause complete server failure (DoS). These vulnerabilities are particularly critical in industrial environments where Milo is used for communication between supervisory systems and field devices.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all deployments of Eclipse Milo to version 1.1.5 immediately, as no security updates are provided for the 0.6.x branch.\u003c/li\u003e\n\u003cli\u003eIdentify and audit all OPC UA server configurations that rely on role-based access control (RBAC), specifically checking if \u003ccode\u003eOpcUaServerConfig.copy()\u003c/code\u003e is used, as this is vulnerable to CVE-2026-58080.\u003c/li\u003e\n\u003cli\u003eRestrict network access to OPC UA endpoints to only known, trusted client IP addresses to mitigate remote unauthenticated exploitation attempts.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for abnormal service crashes or frequent channel disconnects, which may indicate exploitation of the memory exhaustion vulnerability (CVE-2026-63252).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T17:00:41Z","date_published":"2026-10-15T17:00:41Z","id":"https://feed.craftedsignal.io/briefs/2026-10-eclipse-milo-vulnerabilities/","summary":"Multiple high-severity vulnerabilities in Eclipse Milo, including improper authorization and memory management flaws, allow unauthenticated remote attackers to bypass access controls, delete protected nodes, or crash services.","title":"Multiple Critical Vulnerabilities in Eclipse Milo OPC UA Implementation","url":"https://feed.craftedsignal.io/briefs/2026-10-eclipse-milo-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - Eclipse Milo (\u003e=1.0.0, \u003c=1.1.4)","version":"https://jsonfeed.org/version/1.1"}