industrial control systems

CISA on May 28, 2026, published an industrial control systems advisory for CVE-2026-6824, a stored cross-site scripting flaw in CP Plus CP-UNR-108F1 eight-channel network video recorders deployed in India, Nepal, the United Arab Emirates, and Gambia. The bug is not a Windows vulnerability, but...

CISA on May 19, 2026, published an industrial control systems advisory warning that ScadaBR 1.2.0, a Brazil-headquartered open source SCADA platform used worldwide, contains four flaws that can be combined or abused to enable unauthenticated remote code execution against exposed installations...

CISA published an industrial control systems advisory on May 14, 2026, warning that Universal Robots PolyScope 5 versions before 5.25.1 contain a critical command-injection flaw that can let an unauthenticated network attacker execute code on a robot controller. The vulnerability, tracked as...

ABB’s B&R Automation Runtime vulnerability, republished by CISA on May 5, 2026, affects Automation Runtime versions before 6.5 and before R4.93 and can let an unauthenticated network attacker trigger a permanent denial-of-service condition through the ANSL-Server component. It is not a...

SenseLive X3050 has just been pulled into the spotlight for all the wrong reasons, and the headline is hard to soften: CISA says successful exploitation of the newly disclosed vulnerabilities could allow an attacker to take complete control of the device. The advisory covers SenseLive X3050...

Silex Technology’s SD-330AC and AMC Manager have landed in the spotlight after CISA published a fresh industrial control systems advisory on April 21, 2026, warning that a long list of vulnerabilities could enable arbitrary code execution, denial of service, or unauthorized changes to...

Yokogawa’s CENTUM VP has a new hard-coded password vulnerability, and the disclosure matters less because of theoretical severity than because of where the software lives: inside industrial control systems that run real plants, utilities, and manufacturing lines. The issue, tracked as...

A newly disclosed denial-of-service flaw in Mitsubishi Electric’s CNC software stack is a reminder that industrial systems often fail in the least glamorous place: basic input validation. The issue, tracked as CVE-2025-2399, can let a remote attacker trigger an out-of-bounds read by sending...

Siemens has published a focused security advisory for the SICAM SIAPP SDK that warns of multiple memory‑safety and input‑validation flaws in SDK releases before V2.1.7 and urges immediate updates and hardening by anyone building or running SIAPPs. The defects — which Siemens characterizes as an...

Inductive Automation’s Ignition platform has been placed squarely in the spotlight after a coordinated advisory describing a deserialization of untrusted data vulnerability that can execute code during project import — an issue CISA links to CVE-2025-13913 and that affects Ignition installations...

The warning from U.S. federal cyber authorities is blunt: recent coordinated disclosures of multiple security weaknesses in Trane’s Tracer building‑automation family — Tracer SC, Tracer SC+, and Tracer Concierge — create real, actionable risk to building operators and service providers...

CISA’s decision to add five new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog is a timely reminder that attackers continue to leverage both legacy and modern flaws across widely deployed platforms, and that the federal and private sectors must treat remediation as an...

Hitachi Energy's Relion REB500, a cornerstone device for distributed busbar protection in modern substations, has been the subject of coordinated vulnerability disclosures that should be treated as urgent by utilities and integrators. Two privilege-related vulnerabilities — tracked as...

A coordinated set of high‑severity flaws in SWTCH Energy’s public-facing EV charging software has been flagged by U.S. federal cyber authorities, and the implications are wide enough to demand immediate action from operators, property managers, network defenders, and vendors that rely on SWTCH’s...

Copeland’s XWEB family — widely deployed web‑supervisors for refrigeration, HVAC and building‑automation systems — is the subject of a high‑severity coordinated advisory that names a large cluster of authentication‑bypass, input‑validation, path‑traversal, and memory‑safety flaws capable of...

Yokogawa's CENTUM VP family has a new cluster of vulnerabilities that demand urgent attention from OT teams: the vendor has confirmed multiple memory‑safety and packet‑handling flaws in the Vnet/IP Interface Package used with CENTUM VP R6 and R7, and has released a corrective patch (R1.08.00)...

A set of high‑severity flaws in InSAT’s MasterSCADA BUK‑TS — tracked as CVE‑2026‑21410 and CVE‑2026‑22553 and published via a CISA ICS advisory on February 24, 2026 — create a direct path to remote code execution in a widely deployed Russian SCADA product that sits in critical manufacturing...

Hitachi Energy has published a security advisory confirming a default-credentials vulnerability in its SuprOS product (tracked as CVE‑2025‑7740) that affects SuprOS builds up to and including 9.2.2.0; the weakness allows an attacker with local authenticated access to assume an administrative...

A newly published CISA advisory warns that Airleader Master — a widely deployed compressed-air control and monitoring platform — contains a critical file‑upload vulnerability that can be exploited to achieve remote code execution on affected installations. The advisory assigns the flaw...

A critical local privilege–escalation flaw has been disclosed in Mitsubishi Electric’s UPS shutdown utility, FREQSHIP-mini for Windows (CVE-2025-10314), affecting versions 8.0.0 through 8.0.2 and allowing a low‑privileged local user to gain SYSTEM privileges by replacing service executables or...