These vulnerabilities pose a significant risk to industrial control systems (ICS) and critical infrastructure, including the energy, manufacturing, and water sectors. Successful exploitation can lead to unauthorized data access, credential recovery, user impersonation, and total service disruption. Defenders should prioritize migrating affected instances to Eclipse Milo 1.1.5, as no patches are available for the 0.6.x branch.

Impact

Successful exploitation of these vulnerabilities allows unauthenticated remote attackers to compromise the integrity and availability of OPC UA servers. Potential impacts include the permanent deletion of protected data, extraction of sensitive credentials and session metadata, impersonation of authorized users, and the ability to cause complete server failure (DoS). These vulnerabilities are particularly critical in industrial environments where Milo is used for communication between supervisory systems and field devices.

Recommendation

• Upgrade all deployments of Eclipse Milo to version 1.1.5 immediately, as no security updates are provided for the 0.6.x branch.
• Identify and audit all OPC UA server configurations that rely on role-based access control (RBAC), specifically checking if OpcUaServerConfig.copy() is used, as this is vulnerable to CVE-2026-58080.
• Restrict network access to OPC UA endpoints to only known, trusted client IP addresses to mitigate remote unauthenticated exploitation attempts.
• Implement monitoring for abnormal service crashes or frequent channel disconnects, which may indicate exploitation of the memory exhaustion vulnerability (CVE-2026-63252).