Do Son MicroLogix 1400 attacks hit internet-exposed PLCs at water utilities, locking out operators. Rockwell shares recovery and hardening steps.
ICS
CVE-2026-61884 is a Tycon authentication bypass rated CVSS 9.8 in TPDIN-Monitor-WEB2. No vendor fix exists, so isolate the devices now.
Siemens Opcenter X authentication bypass (CVE-2026-56451, CVSS 10) lets attackers forge JWTs for full unauthorized access. Update to V2604 now.
Rockwell Automation vulnerability CVE-2026-10577 (CVSS 10) exposes an unauthenticated debug port in 1715 Redundant I/O modules. Update to firmware 3.011.
Mitsubishi Electric warns of 9.3 CVSS flaws in GENESIS64 & ICONICS. Attackers can leak SQL credentials to destroy or tamper with industrial data. Patch now!
CISA issues an urgent ICS advisory (ICSA-26-057-04) for the EV2GO charging platform. Critical 9.4 severity flaws allow for session hijacking and station impersonation.
Critical ibaPDA flaw CVE-2025-14988 (CVSS 9.8) exposes industrial systems to file tampering. Update to v8.12.1 or harden settings now.
AVEVA issues critical alert for Process Optimization software. CVE-2025-61937 (CVSS 10) allows unauthenticated RCE. Upgrade to version 2025 immediately.
Critical: ABB OPTIMAX flaw CVE-2025-14510 (CVSS 9.2) allows auth bypass via Azure AD. Attackers can shut down systems. Patch or disable SSO now.
METZ CONNECT patched five critical flaws in EWIO-2 industrial controllers. CVE-2025-41734 allows unauthenticated PHP RCE, and CVE-2025-41733 risks admin credential reset. Update to v2.2.0 immediately.
Rockwell patched a critical API flaw (CVE-2025-11862, CVSS 9.9) in Verve Asset Manager, allowing read-only users to escalate privileges and fully compromise OT systems.
GE Vernova patched a Critical Auth Bypass flaw (CVE-2025-3222) in Smallworld Master File Server. The flaw could allow users with system knowledge to circumvent authentication. Update immediately.
Sauter patched six flaws in modulo 6 devices. The Critical CVE-2025-41723 (CVSS 9.8) flaw allows unauthenticated file upload via the SOAP interface, risking RCE. Update to v3.2.0.
ABB disclosed a Critical (CVSS 9.9) Missing Auth flaw (CVE-2025-9574) in EoL ALS-mini-S4/S8 load controllers, allowing unauthenticated remote config access. No patch will be released.
Forescout found pro-Russian hacktivist group TwoNet fabricated critical infrastructure attacks after compromising a honeypot, exploiting a default login, and pushing the false claim on Telegram.
A critical flaw (CVE-2025-41715) in WAGO Device Sphere allows an unauthenticated remote attacker to gain unauthorized access and potentially compromise its database.
CISA issued a security advisory for Delta Electronics DIALink vulnerabilities, including a critical 10.0 CVSS flaw that could allow authentication bypass.
Two critical vulnerabilities in Planet Technology’s Industrial Cellular Gateways could allow unauthenticated attackers to take over devices, exposing critical infrastructure.
A critical RCE vulnerability (CVSS 9.8) in Rockwell's ControlLogix modules poses a severe risk to industrial systems. Update immediately to firmware v12.001.
A critical vulnerability (CVE-2025-7972) in Rockwell Automation's FactoryTalk Linx software allows attackers to bypass authentication and alter industrial networks.
A critical vulnerability (CVE-2025-32433, CVSS 10.0) in Erlang/OTP’s SSH daemon allows unauthenticated RCE and is actively exploited, with a focus on operational technology (OT) networks.
CISA warns of critical flaws in Tigo Energy's Cloud Connect Advanced devices, including hard-coded credentials and command injection, that could allow remote attackers to take full control of solar systems.