Regulatory news and audio briefings from financial regulators worldwide — financial crime, AML, sanctions, fraud, digital assets and compliance

CISA warns of critical EPICS Base flaw enabling remote code execution

CISA has published an ICS advisory covering four vulnerabilities in EPICS Base, open-source control system software used across the critical manufacturing sector worldwide. One flaw carries a critical CVSS score with potential for remote code execution. This briefing sets out the affected versions, the fixes available, and CISA's recommended interim mitigations for operators who cannot patch immediately.

• EPICS Base release 7.0.10 and earlier is affected by four vulnerabilities: CVE-2026-114595, CVE-2026-114596, CVE-2026-114597 and CVE-2026-114598.
• CVE-2026-114595 carries a CVSS v3.1 base score of 9.8 (critical) and could permit remote code execution via an integer overflow in network request processing.
• The EPICS Community has published remediations on GitHub and affected users should update to the 7.0.11 release.
• CISA states no known public exploitation specifically targeting these vulnerabilities has been reported to date.
• The vulnerabilities were reported to CISA by Shubham Raj of Cipher / Causal Security and affect the critical manufacturing sector worldwide.

CISA flags nine flaws in Kiloview E3 encoder, three giving root on the device

CISA's ICS advisory ICSA-26-295-01 documents nine vulnerabilities in the Kiloview E3 NDI encoder, a video appliance used across the communications and information technology sectors worldwide. Several combine to turn authenticated web access, or in one case none at all, into full root compromise. The only remedy on offer is a firmware update. This runs through what the flaws allow and what network owners should do now.

• All nine vulnerabilities affect Kiloview E3 firmware below 1.30, and the vendor's sole remedy is an update to V1.30.
• CVE-2026-107861 and CVE-2026-110243, both OS command injection flaws, each score 9.9 under CVSS v3.1 and 9.4 under CVSS v4.0, allowing an authenticated web user to execute commands as root.
• CVE-2026-109122, a third command injection flaw, scores 9.1 under CVSS v3.1 and 9.4 under CVSS v4.0, and its malicious configuration persists across reboots.
• CVE-2026-92450 uses an HMAC-SHA256 secret hardcoded identically across all devices, letting an attacker with the public firmware forge administrative session tokens without credentials.
• CISA states no known public exploitation specifically targeting these vulnerabilities has been reported at this time.

CISA flags five vulnerabilities in Siemens RUGGEDCOM APE1808 with Nozomi software

CISA has republished a Siemens ProductCERT advisory covering five vulnerabilities in RUGGEDCOM APE1808 devices running Nozomi Networks' Guardian/CMC software. The flaws range from low to high severity and touch dashboard, credential management, polling and login functions used across critical infrastructure deployments worldwide.

• Five CVEs affect all versions of RUGGEDCOM APE1808 running Nozomi Guardian/CMC: CVE-2026-33387, -33388, -33389, -33391 and -33920.
• CVE-2026-33389, an improper certificate validation flaw in Smart Polling, carries the highest individual CVSS 3.1 score of 7.5.
• CVE-2026-33388 scores 7.4 and allows a limited-privilege authenticated user to delete or edit Credentials Manager entries, potentially disrupting authentication.
• Siemens directs affected organizations to contact customer support directly to receive patch and update information rather than publishing a fix in the advisory.
• The advisory was initially released on 2026-10-13 and republished by CISA on 2026-10-22 as SSA-911336.

CISA flags 11 vulnerabilities in Siemens RUGGEDCOM CROSSBOW software

CISA has republished a Siemens ProductCERT advisory covering eleven vulnerabilities in RUGGEDCOM CROSSBOW, a substation management tool used across energy, transportation, manufacturing, healthcare and government sectors worldwide. The flaws range from SQL injection to authorization bypass. Operators running versions below 6.0 should review exposure and plan remediation.

• Siemens has released RUGGEDCOM CROSSBOW V6.0 as the vendor fix for all eleven listed vulnerabilities affecting versions below 6.0.
• CVE-2026-89196 through CVE-2026-89206 cover flaws including SQL injection, authorization bypass, sensitive data exposure and client-side security enforcement.
• The highest CVSS v3.1 base score among the eleven vulnerabilities is 8.8, rated HIGH, for CVE-2026-89196.
• CVE-2026-89199 could allow an authenticated attacker to retrieve administrative credentials for various internal systems.
• Siemens ProductCERT reported the vulnerabilities to CISA, which republished the advisory verbatim as SSA-508506.

CISA flags high-severity flaw in InterSystems IRIS for Health, TLS off by default

CISA has published an ICS Medical Advisory covering a cleartext transmission vulnerability in InterSystems IRIS for Health, a platform used across the healthcare sector worldwide. The flaw stems from TLS/SSL being disabled by default. Compliance and security teams running affected versions should review this briefing before deciding how urgently to act.