Industrial Control Systems

Attackers are exploiting internet-exposed industrial refrigeration controllers using factory-default credentials to force units into defrost mode, causing temperature spikes and food spoilage across European retail chains.

Hitachi Energy TRO600 series products are vulnerable to unauthorized service access via network restriction bypass and unauthenticated arbitrary file read, potentially leading to credential exposure.

A security policy bypass vulnerability in Belden ICX35 industrial gateways allows attackers to reset login lockouts, circumventing authentication security controls.

Johnson Controls has released a security advisory addressing two vulnerabilities in Kantech Entrapass versions prior to 9.20.

CVE-2026-82121 is an Origin Validation Error vulnerability in Hitachi HiRDB.

Siemens has identified an authentication bypass vulnerability in its Mendix SAML module, which could allow unauthenticated attackers to circumvent authentication controls.

The Simple Open EtherCAT Master (SOEM) library version 2.0.0 and earlier fails to validate length and offset fields in device messages, allowing a malicious device to trigger out-of-bounds memory reads.

Multiple memory corruption and validation vulnerabilities in HMS Networks PEAK-System Windows drivers allow local attackers to induce a system kernel crash.

Moxa has disclosed two critical vulnerabilities, CVE-2026-109812 and CVE-2026-109813, affecting the AIG-302 industrial computing series firmware version 1.4.1 and earlier.

Lantronix XPress-DR and XPress-DR-I devices running firmware version 8.1.0.0 and earlier are vulnerable to remote configuration manipulation via an unauthenticated UDP configuration protocol.

Multiple vulnerabilities in Siemens SIMATIC S7 products enable unauthenticated or local attackers to execute arbitrary code, escalate privileges, manipulate data, or cause a denial-of-service.

Multiple high and critical severity vulnerabilities in Red Lion Controls N-Tron 700 series switches, including hard-coded credentials and improper authentication, allow for unauthorized administrative access, configuration theft, and denial-of-service.

A critical buffer overflow vulnerability (CVE-2026-15340) in Savannah lwIP SMTP client 2.2.1 allows unauthenticated remote attackers to trigger denial-of-service or potential remote code execution.

Moxa has disclosed two critical vulnerabilities, CVE-2026-86325 and CVE-2026-86326, affecting MGate 3000 and 5000 series protocol gateways.

An unauthenticated remote attacker can exploit an improper input validation vulnerability (CVE-2026-89207) in Siemens WTV676 and WTV776 devices to force them into protection mode, resulting in a permanent loss of remote web access.

A critical out-of-bounds write vulnerability (CVE-2026-15579) in Moxa TN-4500B Series switches allows remote, unauthenticated attackers to cause a denial-of-service condition.

A stack-based buffer overflow vulnerability in the web server of PLANET IGS-5225-8P2T4S industrial managed switches allows authenticated remote attackers to achieve denial of service or remote code execution via CVE-2026-81944.

An incorrect implementation of the authentication algorithm (CVE-2026-15688) in Mitsubishi Electric GX Works3 and Motion Control Settings allows local attackers to bypass block password protections and manipulate control programs.

Schneider Electric SCADAPack x70 series RTUs contain a vulnerability (CVE-2026-81861) in the legacy 'Secure Lock' functionality that could lead to unauthorized exposure of authentication information.

CVE-2026-90782 is a NULL pointer dereference vulnerability in S2OPC 1.7.3 and earlier, allowing an attacker to trigger a denial-of-service crash via manipulated allocation sequences.

AVEVA Pipeline Integrity Monitor versions through 2025_SP1_P1_build_7.1.9580.8513 contain multiple vulnerabilities including hard-coded keys and improper authorization, facilitating information disclosure, credential brute-forcing, and XSS-based code execution.

Rockwell Automation FactoryTalk Activation Manager versions V5.02 and below are vulnerable to local privilege escalation via insecure installer custom actions that spawn SYSTEM-level console windows.

Rockwell Automation Redundancy Module Configuration Tool versions 9.x and 10.00.00 are vulnerable to DLL hijacking, potentially allowing local privilege escalation to SYSTEM level.

Rockwell Automation Logix controllers are vulnerable to a denial-of-service condition due to improper input length validation during CIP message processing, leading to major nonrecoverable faults.

Talassoft Industrial Management Software versions 4 through 16 contain a hard-coded credentials vulnerability, enabling unauthorized attackers to retrieve sensitive embedded data.

Klemsan KIO versions prior to 1.9 contain a code injection vulnerability allowing unauthenticated attackers to execute arbitrary code due to improper input validation during code generation.

An out-of-bounds read vulnerability (CVE-2025-2399) in Mitsubishi Electric CNC Series controllers allows remote attackers to trigger a denial-of-service condition via crafted packets sent to TCP port 683.

A vulnerability in the Ethernet function of multiple Mitsubishi Electric factory automation products allows remote attackers to trigger a denial-of-service condition via specially crafted UDP packets.

Cisco Industrial Ethernet 1000 Series Switches contain multiple vulnerabilities, including CVE-2024-20412, CVE-2024-20413, and CVE-2024-20414, which allow unauthenticated attackers to cause a denial-of-service or perform cross-site scripting attacks.

CVE-2026-14950 is an insufficient session expiration vulnerability in Frauscher Sensortechnik FDS 102 that allows an attacker with a valid session identifier to maintain access beyond the intended expiration time.

Siemens Simcenter Femap is susceptible to arbitrary code execution via two out-of-bounds read vulnerabilities when parsing specially crafted BMP files.

A critical OS command injection vulnerability (CVE-2026-3014) in Siemens Siveillance Video allows authenticated users with administrative permissions to achieve remote code execution in the context of the Management Server service.

A stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-34491) in Johnson Controls Metasys allows low-privileged users to execute arbitrary scripts in the context of other users' sessions, potentially leading to session hijacking.

Siemens Parasolid contains an out-of-bounds read vulnerability (CVE-2026-64629) in its X_T file parsing logic that can lead to arbitrary code execution or application crashes.

A local OS command injection vulnerability (CVE-2026-44095) in Phoenix Contact CHARX charging controllers allows low-privileged users to execute arbitrary commands as root.

A critical vulnerability (CVE-2026-44090) in Phoenix Contact CHARX SEC controllers allows unauthenticated remote attackers to gain full device control by bypassing authentication on the MQTT broker.

A low-privileged remote attacker can exploit an incorrect behavior order vulnerability (CVE-2026-14169, CWE-696) in multiple ads-tec Industrial IT DVG-IRF series devices (versions prior to 2.3.0) by sending crafted input, leading to inconsistent account states and password overwrites, resulting in complete administrative unavailability of the device.

An authenticated attacker can exploit CVE-2026-11826, a heap-based buffer overflow in OpenPLC_v3's web interface, by sending a crafted HTTP POST request to the /modbus endpoint with an oversized device_name value, causing heap corruption, a runtime crash, and denial of service of the PLC process control loop, with no expected patch.

Unit 42 and Siemens collaborated to disclose three critical chained zero-day vulnerabilities (CVE-2025-40948, CVE-2025-40947, CVE-2025-40949) in Siemens ROX II operational technology switches, allowing an attacker to achieve arbitrary file disclosure, privilege escalation to root, and persistent root-level code execution.

A denial-of-service vulnerability (CVE-2026-9653) in Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT communication modules, due to improper validation of CIP Implicit Connection packets, allows an unauthenticated network attacker to continuously disrupt device connections.

Multiple vulnerabilities, including out-of-bounds write, out-of-bounds read, and divide-by-zero, exist in AutomationDirect Productivity Suite versions up to and including v4.6.2.2, allowing an attacker with local or physical access to exploit these flaws via crafted IOCTL requests, potentially leading to kernel memory corruption, privilege escalation, information disclosure, application instability, or a denial-of-service condition.

CISA has issued an advisory regarding critical and high-severity vulnerabilities CVE-2025-14771, CVE-2025-14772, CVE-2025-14773, and CVE-2025-14774 in ABB T-MAC Plus version 4.0-24, which could allow authenticated attackers to exfiltrate sensitive files, bypass authorization for administrative operations, execute arbitrary client-side code via cross-site scripting, or for unauthenticated attackers to cause a denial-of-service condition.

Siemens released a security advisory on May 12, 2026, addressing vulnerabilities in a range of products including RUGGEDCOM, SCALANCE, Solid Edge, and SIMATIC, prompting users to apply necessary updates.

An authenticated local attacker can gather credential information from ABB B&R PVI client application logs when logging is enabled, addressed in version 6.5.0 (CVE-2026-0936).

CVE-2026-25293 is a critical buffer overflow vulnerability in Qualcomm PLC FW due to incorrect authorization, potentially allowing unauthorized access and control over programmable logic controllers.

Moxa released a security advisory addressing CVE-2026-3867 and CVE-2026-3868, which affect TN-4900, EDR-8010, EDR-G9010, OnCell G4302-LTE4, OnCell G4308-LTE4, and EDF-G1002-BP series routers, potentially allowing for unauthorized access and control.