Do Son CVE-2026-16462 is a critical SQL injection in Weidmueller PROCON-WEB SCADA, rated CVSS 9.8. An unauthenticated attacker can run SQL commands. Patch now.
SCADA
Cato Networks reveals 235,500+ Modbus probes on PLCs across 70 countries. Learn how attackers fingerprint and hijack industrial control systems. Patch now.
Mitsubishi Electric warns of 9.3 CVSS flaws in GENESIS64 & ICONICS. Attackers can leak SQL credentials to destroy or tamper with industrial data. Patch now!
FBI and CISA warn of Iranian APTs hijacking internet-facing PLCs to disrupt U.S. energy and water systems. Learn the 2026 TTPs and how to defend your OT.
Critical flaws (CVE-2025-41709) in Janitza and Weidmueller energy meters allow remote code execution and full system takeover. Update to firmware 3.14 now.
Critical flaws in WAGO 852 switches (CVSS 9.8) allow remote takeover via hardcoded keys & buffer overflows. Update firmware 2.64 immediately.
New "APT IRAN" framework targets energy grids & military networks. Lab52 links the tool to the IRGC. See the threat to critical infrastructure.
Critical ibaPDA flaw CVE-2025-14988 (CVSS 9.8) exposes industrial systems to file tampering. Update to v8.12.1 or harden settings now.
AVEVA issues critical alert for Process Optimization software. CVE-2025-61937 (CVSS 10) allows unauthenticated RCE. Upgrade to version 2025 immediately.
Critical: ABB OPTIMAX flaw CVE-2025-14510 (CVSS 9.2) allows auth bypass via Azure AD. Attackers can shut down systems. Patch or disable SSO now.
Urgent: Siemens Edge flaw CVE-2025-40805 (CVSS 10) allows remote account takeover. Update SIMATIC & IOT2050 devices immediately to secure ops.
A critical vulnerability (CVE-2025-7972) in Rockwell Automation's FactoryTalk Linx software allows attackers to bypass authentication and alter industrial networks.
CISA and Schneider Electric warn of critical, actively exploited RCEs in EcoStruxure Power Operation (EPO), impacting industrial control systems. Public exploits are available.
CISA warns of critical flaws in Emerson ValveLink software, exposing cleartext data, allowing code execution, and compromising industrial systems. Update to v14.0 now.
Siemens warns of critical flaws (CVE-2025-40736 CVSS 9.8 Auth Bypass, SQLi, Path Traversal) in SINEC NMS, allowing unauthenticated remote root access and RCE.
A critical flaw (CVE-2025-41672, CVSS 10.0) in WAGO Device Sphere allows unauthenticated attackers full admin control via shared default JWT certificates. Update to v1.0.1 immediately!
CERT@VDE and Pilz disclose critical flaws in IndustrialPI 4: unauthenticated remote bypass (CVSS 9.6) and RCE (CVSS 10.0) via exposed Node-RED. Update or mitigate immediately.
A critical flaw (CVE-2025-3699) in Mitsubishi Electric AC systems allows remote authentication bypass, risking illegal control and firmware tampering.
Hitachi Energy warns of 5 flaws in MicroSCADA X SYS600 (v10.0-10.6), including remote DoS, data leaks, and TLS MITM, risking power system control.
Singapore's CSA warns of critical flaws in Advantech WISE-4010/50/60LAN industrial products, allowing unauthenticated firmware upload & Modbus manipulation.
CISA warns of a critical vulnerability (CVE-2025-1907) in Instantel Micromate devices, allowing unauthenticated remote command execution. Immediate action is advised.
A recent attack by the Ransomhub ransomware gang has amplified concerns about the vulnerability of these critical systems