Regulatory news and audio briefings from financial regulators worldwide — financial crime, AML, sanctions, fraud, digital assets and compliance

Siemens patches SAML replay flaw in Mendix module across three versions

Siemens' ProductCERT has disclosed an authentication bypass in its Mendix SAML module affecting versions compatible with Mendix 9, 10 and 11. The advisory, republished by CISA, covers an unauthenticated replay attack and sets out vendor fixes and an interim mitigation for Critical Manufacturing and IT sector operators running affected builds.

• CVE-2026-89209 affects Mendix SAML module versions below V4.2.4 (Mendix 10 and 11 compatible) and below V3.6.29 (Mendix 9 compatible).
• The flaw allows an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows.
• CVSS v3.1 base score is 6.8, rated medium severity, with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N.
• Siemens recommends updating to V4.2.4 or later, or V3.6.29 or later depending on the module, and disabling IdP-initiated SSO as an interim mitigation.
• Siemens ProductCERT reported the vulnerability to CISA, which republished the advisory verbatim as SSA-137528 on October 29, 2026.

CISA warns of critical EPICS Base flaw enabling remote code execution

CISA has published an ICS advisory covering four vulnerabilities in EPICS Base, open-source control system software used across the critical manufacturing sector worldwide. One flaw carries a critical CVSS score with potential for remote code execution. This briefing sets out the affected versions, the fixes available, and CISA's recommended interim mitigations for operators who cannot patch immediately.

• EPICS Base release 7.0.10 and earlier is affected by four vulnerabilities: CVE-2026-114595, CVE-2026-114596, CVE-2026-114597 and CVE-2026-114598.
• CVE-2026-114595 carries a CVSS v3.1 base score of 9.8 (critical) and could permit remote code execution via an integer overflow in network request processing.
• The EPICS Community has published remediations on GitHub and affected users should update to the 7.0.11 release.
• CISA states no known public exploitation specifically targeting these vulnerabilities has been reported to date.
• The vulnerabilities were reported to CISA by Shubham Raj of Cipher / Causal Security and affect the critical manufacturing sector worldwide.

CISA flags hard-coded credentials in end-of-life Johnson Controls EasyIO FG

CISA republished a Johnson Controls advisory covering two vulnerabilities in the EasyIO FG building-automation controller that could hand an attacker full control of the device. Because the product line is end-of-life, no patch is coming. For anyone running these controllers in operational-technology estates, the only remedy is network isolation now and replacement later.

• Two vulnerabilities, CVE-2026-27872 and CVE-2026-27873, affect EasyIO FG firmware version 2.0b52 and earlier, each scored CVSS v3.1 7.7 and CVSS v4 7.2.
• Johnson Controls will issue no firmware patch because the EasyIO FG Series is end-of-life and end-of-support and the source code is no longer available.
• Users are advised to migrate to a supported current-generation product such as the EasyIO Neo R1 Series.
• CISA lists extensive interim mitigations including network isolation, VLAN segmentation, no internet exposure and disabling insecure services such as Telnet.
• CISA reports no known public exploitation targeting these vulnerabilities, which have high attack complexity and are not exploitable remotely.

CISA warns of critical buffer overflow in Savannah lwIP SMTP client

CISA has published an advisory for a critical vulnerability in the Savannah lwIP SMTP client used in industrial control systems across the energy and water sectors. The item covers the flaw's severity, affected version, and the patch now available for remediation.

• CVE-2026-15340 affects Savannah lwIP SMTP client version 2.2.1 and carries a CVSS v3.1 base score of 9.8, rated critical.
• The flaw is a classic buffer overflow (CWE-120) caused by the SMTP client not checking the size of inputs.
• The product is deployed worldwide across the energy and water and wastewater systems sectors, per CISA's background notes.
• A fix is available as patch_125_smtp_txbuf.diff and as git commit 614420f82c8729d070e01464c0dddb3c9525c772.
• Reporter xchglabs disclosed the vulnerability directly to Savannah and published only after the patch was released.

CISA adds six actively exploited flaws to known vulnerabilities catalog

CISA's latest KEV Catalog update adds six CVEs spanning Plex Media Server, EG Secure Solutions SiteGuard Server Edition and Siemens Software Center. The addition triggers remediation obligations under Binding Operational Directive 26-04 for federal civilian agencies and signals priority risk for any organization running the affected software.

• CISA added six CVEs to the KEV Catalog on October 20, 2026 based on evidence of active exploitation.
• Four of the six vulnerabilities affect Plex Media Server: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656.
• CVE-2026-106931 affects EG Secure Solutions SiteGuard Server Edition via OS command injection.
• CVE-2026-110936 affects Siemens Software Center through an uncontrolled search path element vulnerability.
• BOD 26-04 requires FCEB agencies to prioritize remediation of KEV vulnerabilities on publicly exposed assets granting total control post-exploitation and to check for pre-patch compromise.

Siemens RUGGEDCOM CROSSBOW controller has critical SQLite flaw, CVSS 9.8

CISA has republished a Siemens ProductCERT advisory detailing five vulnerabilities in the SQLite component embedded in RUGGEDCOM CROSSBOW Station Access Controller software used across critical infrastructure sectors. One flaw carries a CVSS v3 score of 9.8. Security and OT teams running affected versions should assess exposure and schedule the vendor update.

• Siemens has released RUGGEDCOM CROSSBOW SAC version V6.0 to remediate all five listed vulnerabilities, and recommends updating from any version below V6.0.
• CVE-2025-71316 is rated CVSS v3 9.8, critical, and involves insecure handling of Unicode-to-ANSI conversion in SQLite's sqldiff.exe that could allow an attacker to load an arbitrary DLL.
• CVE-2026-11822 and CVE-2026-11824 affect SQLite versions before 3.53.2 and involve heap-based buffer overflows in the FTS5 full-text search extension triggered via crafted database files.
• CVE-2025-6965 affects SQLite versions before 3.50.2 and can cause memory corruption when aggregate terms exceed available columns.
• Siemens ProductCERT reported the vulnerabilities to CISA, and the advisory is a verbatim republication of Siemens advisory SSA-765416.

CISA flags nine flaws in Kiloview E3 encoder, three giving root on the device

CISA's ICS advisory ICSA-26-295-01 documents nine vulnerabilities in the Kiloview E3 NDI encoder, a video appliance used across the communications and information technology sectors worldwide. Several combine to turn authenticated web access, or in one case none at all, into full root compromise. The only remedy on offer is a firmware update. This runs through what the flaws allow and what network owners should do now.

• All nine vulnerabilities affect Kiloview E3 firmware below 1.30, and the vendor's sole remedy is an update to V1.30.
• CVE-2026-107861 and CVE-2026-110243, both OS command injection flaws, each score 9.9 under CVSS v3.1 and 9.4 under CVSS v4.0, allowing an authenticated web user to execute commands as root.
• CVE-2026-109122, a third command injection flaw, scores 9.1 under CVSS v3.1 and 9.4 under CVSS v4.0, and its malicious configuration persists across reboots.
• CVE-2026-92450 uses an HMAC-SHA256 secret hardcoded identically across all devices, letting an attacker with the public firmware forge administrative session tokens without credentials.
• CISA states no known public exploitation specifically targeting these vulnerabilities has been reported at this time.

CISA flags Siemens WinCC privilege escalation flaw with no fix for V7.5

CISA has republished a Siemens ProductCERT advisory covering a high-severity privilege escalation flaw in SIMATIC WinCC, the SCADA system used across critical manufacturing, energy, healthcare, transport, government and financial services. Siemens has shipped fixes for two version lines but has none for V7.5. The flaw lets an authenticated user with database access execute commands on the underlying host.

• CVE-2026-59241 carries a CVSS v3.1 base score of 8.8 (HIGH), vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
• All versions of SIMATIC WinCC V7.5 are affected and no fix is currently available.
• Siemens has fixed the flaw in V8.0 Update 11 and V8.1 Update 7; users should update to those or later versions.
• An authenticated remote attacker with database access can escalate privileges and execute arbitrary commands on the host running WinCC.
• CISA recommends minimising network exposure, placing control systems behind firewalls and using secure remote access such as VPNs.

CISA republishes Siemens advisory on PSS(R)SINCAL WibuKey flaw

CISA has republished Siemens ProductCERT advisory SSA-148322 covering a high-severity vulnerability in PSS(R)SINCAL that stems from its use of the third-party WibuKey product. The flaw can cause a denial-of-service crash. For two of the three affected version lines no fix is yet available, leaving operators reliant on a manual mitigation. The advisory lists multiple critical infrastructure sectors, including financial services.

• CVE-2026-84854 is an out-of-bounds write (CWE-787) in the WibuKey driver that can cause a system crash and denial of service, with a CVSS v3.1 base score of 7 (HIGH).
• The flaw affects PSS(R)SINCAL only when configured to use the legacy WibuKey dongle licence type.
• PSS(R)SINCAL V21.5 (all) and V22.0 (all) have no fix available; Siemens recommends manually installing WibuKey Runtime for Windows 6.72 or later as mitigation.
• PSS(R)SINCAL V22.5 before V22.5 Update 5 is affected and is remediated by updating to Update 5 or later.
• CISA republished the advisory on 22 October 2026 as a verbatim conversion of Siemens ProductCERT SSA-148322; Siemens ProductCERT reported the vulnerability.

CISA flags five vulnerabilities in Siemens RUGGEDCOM APE1808 with Nozomi software

CISA has republished a Siemens ProductCERT advisory covering five vulnerabilities in RUGGEDCOM APE1808 devices running Nozomi Networks' Guardian/CMC software. The flaws range from low to high severity and touch dashboard, credential management, polling and login functions used across critical infrastructure deployments worldwide.

• Five CVEs affect all versions of RUGGEDCOM APE1808 running Nozomi Guardian/CMC: CVE-2026-33387, -33388, -33389, -33391 and -33920.
• CVE-2026-33389, an improper certificate validation flaw in Smart Polling, carries the highest individual CVSS 3.1 score of 7.5.
• CVE-2026-33388 scores 7.4 and allows a limited-privilege authenticated user to delete or edit Credentials Manager entries, potentially disrupting authentication.
• Siemens directs affected organizations to contact customer support directly to receive patch and update information rather than publishing a fix in the advisory.
• The advisory was initially released on 2026-10-13 and republished by CISA on 2026-10-22 as SSA-911336.

CISA flags 11 vulnerabilities in Siemens RUGGEDCOM CROSSBOW software

CISA has republished a Siemens ProductCERT advisory covering eleven vulnerabilities in RUGGEDCOM CROSSBOW, a substation management tool used across energy, transportation, manufacturing, healthcare and government sectors worldwide. The flaws range from SQL injection to authorization bypass. Operators running versions below 6.0 should review exposure and plan remediation.

• Siemens has released RUGGEDCOM CROSSBOW V6.0 as the vendor fix for all eleven listed vulnerabilities affecting versions below 6.0.
• CVE-2026-89196 through CVE-2026-89206 cover flaws including SQL injection, authorization bypass, sensitive data exposure and client-side security enforcement.
• The highest CVSS v3.1 base score among the eleven vulnerabilities is 8.8, rated HIGH, for CVE-2026-89196.
• CVE-2026-89199 could allow an authenticated attacker to retrieve administrative credentials for various internal systems.
• Siemens ProductCERT reported the vulnerabilities to CISA, which republished the advisory verbatim as SSA-508506.

CISA flags ZigBee DoS flaw in Siemens SENTRON 3NA COM Fuse

This advisory covers a medium-severity denial-of-service vulnerability in Siemens SENTRON 3NA COM Fuse units running firmware below V5.2, deployed worldwide across multiple critical infrastructure sectors. Operators running affected versions should read the fix path and recommended network protections before deciding on patch timing.

• CVE-2024-7322 affects SENTRON 3NA COM Fuse versions below V5.2 and carries a CVSS v3.1 base score of 5.8 (medium).
• An unsolicited encrypted rejoin response can change a ZigBee device's node ID, causing a denial-of-service condition.
• Recovery from the DoS condition requires the affected network to be re-established.
• Siemens' remediation is to update affected devices to V5.2 or later.
• The advisory lists deployment across critical manufacturing, transportation, energy, healthcare, financial services and government facilities sectors worldwide.

Siemens Software Center flaw under active exploitation, CISA confirms

CISA has republished a Siemens ProductCERT advisory covering a DLL hijacking flaw in Siemens Software Center, a tool used across critical manufacturing, energy, healthcare, financial services and government facilities deployments worldwide. The advisory notes active exploitation and directs users to apply the vendor's fix, which auto-updates on next startup.

• CVE-2026-110936 affects Siemens Software Center versions prior to V4.0.9.8 via an uncontrolled DLL search path (CWE-427).
• CVSS v3.1 base score is 6.7 (medium), with vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, requiring local access and high privileges.
• Siemens states existing Software Center installations will be auto-updated to V4.0.9.8 or later on next startup.
• The advisory references a Siemens blog post providing additional information on current known active exploitation and how to detect it.
• Revision 3 of the advisory, dated 2026-10-19, added the reference to active exploitation, two days after initial publication.

CISA flags high-severity flaw in InterSystems IRIS for Health, TLS off by default

CISA has published an ICS Medical Advisory covering a cleartext transmission vulnerability in InterSystems IRIS for Health, a platform used across the healthcare sector worldwide. The flaw stems from TLS/SSL being disabled by default. Compliance and security teams running affected versions should review this briefing before deciding how urgently to act.

CISA flags out-of-bounds read flaw in Siemens Capital Embedded AR Classic

CISA has republished a Siemens ProductCERT advisory covering an out-of-bounds read vulnerability in Capital Embedded AR Classic, used across manufacturing, energy, transport, healthcare, financial services and government facility sectors worldwide. The advisory sets out which versions are fixed, which have no fix planned, and what mitigations operators should apply in the interim.

• CVE-2026-89208 is an out-of-bounds read vulnerability with a CVSS v3.1 base score of 5.3, rated medium severity.
• Capital Embedded AR Classic R20-11 versions before V2303 should be updated to V2303 or later, per Siemens' vendor fix.
• Siemens has no fix planned for Capital Embedded AR Classic 431-422 and recommends mitigation only.
• Siemens recommends applying network segmentation and placing ECUs behind properly configured gateways and firewalls for both affected versions.
• The product is deployed worldwide across Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, and Government Services and Facilities sectors.

CISA flags denial-of-service flaws in Siemens building automation controllers

CISA's advisory covers multiple remotely exploitable vulnerabilities in widely deployed Siemens building automation controllers used across critical manufacturing, energy, healthcare, financial services and government facilities worldwide. Compliance and OT security teams running APOGEE, TALON or Desigo PXC/PXM equipment should check which product lines have patches available versus those left on mitigation-only guidance.

• CISA released advisory ICSA-26-295-08 on October 22, 2026 covering Siemens APOGEE, TALON and Desigo PXC/PXM products.
• The highest-rated vulnerability, affecting APOGEE MBC (PPC) BACnet, carries a CVSS v3 base score of 8.2 across three CWE categories: out-of-bounds read, integer underflow and stack-based buffer overflow.
• Siemens has issued vendor fixes for APOGEE PXC Compact/Modular and TALON TC Compact/Modular, updating to V3.5.7 (BACnet) or V2.8.21 (P2 Ethernet).
• Siemens states no fix is planned for APOGEE MBC/MEC (PPC) variants or any of the thirteen listed Desigo PXC/PXM controller models.
• Recommended mitigations for unpatched products include network segmentation behind gateways/firewalls and disabling the FTP/Web service, which Siemens says is off by default.

CISA and Canadian Cyber Centre issue joint guidance on AI token consumption

CISA, Canada's Cyber Centre and partners released joint guidance on managing token consumption in third-party super intelligence services. It treats unmanaged token usage not as a billing nuisance but as an availability and resilience problem for critical infrastructure, and sets out practical steps to prioritise, monitor and optimise consumption while keeping human oversight of AI-enabled defence workflows.

• CISA, the Canadian Centre for Cyber Security and partners jointly published the guidance on 22 October 2026.
• The guidance names token exhaustion and denial-of-tokens or denial-of-wallet attacks as risks of unmanaged consumption.
• Recommended steps include prioritising token allocation, caching and reusable context, optimising data before submission, and monitoring consumption over time.
• Critical infrastructure owners are told to identify mission-critical functions dependent on SI and plan for reduced availability during outages, incidents or high demand.
• Cyber defenders are advised to run SI-enabled defence workflows while maintaining human oversight, governance and cybersecurity fundamentals.

CISA urges patching critical BeyondTrust Remote Support flaw under active attack

CISA has flagged a critical authentication bypass vulnerability in BeyondTrust Remote Support that threat actors are actively exploiting for initial access, persistence and lateral movement. This briefing covers which versions are affected, what patch to apply, and the forensic steps CISA recommends for organizations that suspect compromise.

• CVE-2026-102764 affects BeyondTrust Remote Support versions 26.2.3 and earlier and was added to CISA's KEV catalog on October 16, 2026.
• Patches are available for supported versions 24.3.1 and later via the BT26-05-RS patch; older self-hosted versions require upgrading first.
• BeyondTrust-hosted SaaS Remote Support deployments have already been patched by the vendor.
• CISA recommends organizations conduct network and memory forensics and, if compromise is suspected, isolate appliances and forward syslog and session events to the SIEM.
• Organizations should rebuild from a known-good state, apply the patch, rotate every credential the appliance stored or injected, and revoke active support sessions.

CISA urges immediate patching of two critical PHP remote code flaws

CISA has issued an alert on two critical PHP vulnerabilities enabling unauthenticated remote code execution across all PHP installations serving web requests. The agency gives specific patched versions and tells organizations to inventory PHP usage, patch internet-facing systems first, and take unpatched systems offline if updates cannot be applied immediately.

• CISA's alert covers two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known collectively as php2shell.
• The flaws allow unauthenticated remote code execution and affect all PHP installations serving web requests.
• Organizations should update immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
• Systems still running PHP 8.1 or earlier unsupported versions should be taken offline until patched.
• CISA says it has not observed exploitation of these vulnerabilities as of the time of publication.

CISA and FBI Issue Joint Advisory on SafePay Ransomware After 600 Victims

This joint advisory from FBI, CISA, USSS and European law enforcement partners sets out the tactics, techniques and indicators of compromise used by SafePay ransomware actors, who have hit at least 600 victims across four continents. Security and incident response teams should use this to update detection rules and patch the specific CVEs named.

• SafePay threat actors have affected at least 600 separate victims across multiple critical infrastructure sectors since August 2024.
• The advisory names five CVEs exploited for initial access, including CVE-2024-40711 and CVE-2024-40766 affecting edge device products.
• SafePay uses a hybrid ChaCha20 stream cipher and RSA public-key encryption scheme, appending encrypted files with the .SafePay extension.
• Indicators of compromise listed were observed between November 2024 and August 2026, including IP addresses, malicious files and SHA-1 and SHA-256 hash values.
• Authoring agencies include the FBI, CISA, USSS, Germany's Landeskriminalamt Rheinland-Pfalz, and two UK agencies, based on investigations as recently as August 2026.

CISA warns of hard-coded crypto key flaw in Moxa AIG-302 edge gateway

CISA's advisory covers two flaws in Moxa's AIG-302 ThingsPro Edge, used across critical manufacturing, energy and water sector deployments worldwide. One allows a privileged authenticated attacker to pull cryptographic secrets via an internal API; the other exposes a hard-coded private key reachable without authentication. Moxa has shipped firmware v1.4.1 to fix both.

• CVE-2026-109812 lets a privileged authenticated attacker with adjacent network access extract cryptographic key material via the /api/v1/secrets/ API, rated CVSS v3.1 6.8.
• CVE-2026-109813 involves a hard-coded cryptographic key in /usr/bin/sysman exploitable by an unauthenticated adjacent attacker, rated CVSS v3.1 8.1 (v4.0: 8.6).
• Both flaws affect Moxa AIG-302 ThingsPro Edge firmware versions 1.4.0 and earlier; Moxa has released fixed firmware v1.4.1.
• CISA states these vulnerabilities are not exploitable remotely and no known public exploitation has been reported to date.
• Affected deployments span the Critical Manufacturing, Energy, and Water and Wastewater Systems sectors worldwide, per CISA's background section.

CISA flags privilege-escalation flaws in WAGO industrial controller firmware

CISA's advisory ICSA-26-293-02 details two vulnerabilities affecting WAGO CC100, PFC100 G2, PFC200 G2, TP600, Edge Controller and WP400 devices running firmware below version 4.10.0. Operators in chemical, energy, water and other critical infrastructure sectors using these controllers should review the advisory to assess exposure and plan firmware updates.

• CISA advisory ICSA-26-293-02, released October 20, 2026, covers two vulnerabilities tracked as CVE-2026-80466 and CVE-2026-88850.
• The flaw in routing configuration (CVE-2026-80466) carries a CVSS v3 score of 8.8 and allows a low-privileged remote attacker to inject OS shell commands.
• Affected firmware spans versions from 1.0.0 up to but excluding 4.10.0, installed on WAGO hardware including 0751-9x01, 0750-811x, 0762-420x and several other product lines.
• WAGO recommends users update to firmware Version 4.10.0 (FW32) or higher and contact WAGO support for custom firmware builds.
• Additional detail is available in WAGO's own security advisory VDE-2026-096, referenced in both HTML and CSAF formats.

CISA flags six flaws in HMS Networks PEAK-System PCAN Windows drivers

CISA has published an advisory covering six vulnerabilities in HMS Networks PEAK-System PCAN Windows CAN device drivers, used across transportation, healthcare, energy and critical manufacturing sectors worldwide. The flaws allow a local attacker to crash the Windows kernel. A patched version is available, and the item sets out what affected and what operators should do.

• CISA's advisory ICSA-26-293-01, dated October 20, 2026, covers six CVEs affecting HMS Networks PEAK-System Device Driver Setup version 5.1.2.1151 and earlier and PCAN Windows CAN device drivers version 5.1.2 and earlier.
• The highest-rated flaw, CVE-2026-103672, carries a CVSS v3.1 base score of 7.1 (high) for improper validation of an array index.
• HMS Networks AB has addressed all six vulnerabilities in version 5.1.4 and recommends users upgrade via its software download page.
• CISA states the vulnerabilities are not exploitable remotely and that no known public exploitation targeting them has been reported.
• Affected critical infrastructure sectors deployed worldwide include transportation systems, healthcare and public health, energy, and critical manufacturing.

CISA flags critical hard-coded credential flaw in EseeCloud IP cameras; vendor unresponsive

CISA has published an advisory on three vulnerabilities in Guangzhou Juan IoT Technology's EseeCloud IP camera app and firmware, one rated 9.8 critical. The flaws allow full device takeover, unauthorised rebinding and large-scale device enumeration. The vendor did not respond to CISA's coordination attempts, so no fix exists and the only remedy is network isolation.

• CVE-2026-107617 lets an attacker use a hard-coded credential to log in to EseeCloud devices, rated CVSS v3.1 9.8 critical.
• CVE-2026-97858 allows the server to unbind a device from its owner and rebind it to an attacker's account, exposing the device's full serial ID.
• CVE-2026-105664 creates an enumeration oracle, letting an attacker with a valid token discover registered devices across a 10-digit search space absent rate limiting.
• Guangzhou Juan IoT Technology did not respond to CISA's coordination attempts, so no patch is available and CISA advises network isolation.
• Affected equipment is deployed worldwide across energy, communications, transportation, financial services and government sectors.

CISA and FBI warn election and campaign officials of phishing ahead of 2026 midterms

CISA and the FBI have issued a joint Public Service Announcement warning election and campaign officials about cyber threats during the 2026 U.S. midterm elections. The notice describes phishing and smishing campaigns that mimic legitimate communications to steal credentials and deploy malware. For anyone handling voter data or sensitive campaign information, it sets out who is being targeted and why, and points to recommended practices.

• CISA and the FBI released a joint Public Service Announcement on October 16, 2026 warning of cyber threats to the 2026 U.S. midterm elections.
• The agencies say actors may use phishing and smishing to steal login credentials and sensitive information or to install malware on targeted devices.
• Election officials, candidates and political organisations are named as targets because of access to voter registration data, government officials and sensitive campaign information.
• The notice warns that campaigns increasingly use convincing emails, text messages, audio and video to manipulate recipients into disclosing information or interacting with malicious links and attachments.

CISA flags six Eclipse Milo flaws exposing OPC UA servers to credential theft and denial of service

CISA's October 15 industrial-control advisory covers multiple vulnerabilities in Eclipse Foundation's Eclipse Milo OPC UA server software. The flaws range from authorization bypasses to a password-recovery padding oracle and several denial-of-service conditions. For operators in chemical, critical manufacturing, energy and water sectors, the practical sting is that affected 0.6.x deployments cannot be patched in place and must be migrated to 1.1.5 or later.

• CISA advisory ICSA-26-288-01, released October 15, 2026, covers vulnerabilities in Eclipse Milo versions 0.6.0 through 1.1.4.
• CVE-2026-60007, a padding-oracle flaw enabling password recovery, carries a CVSS v4 base score of 9.1, rated critical.
• The Eclipse Foundation recommends upgrading to Eclipse Milo 1.1.5; there are no 0.6.x releases with the fixes, requiring migration.
• Successful exploitation could delete protected data, recover credentials and impersonate users, or stop the server responding to all clients.
• Affected deployments span the chemical, critical manufacturing, energy, and water and wastewater sectors worldwide.

CISA flags seven flaws in its own Malcolm network-monitoring tool, top score 8.1

CISA has published advisory ICSA-26-280-01 covering seven CVEs in Malcolm, its own network traffic analysis platform, deployed worldwide across energy, IT and water sectors. The defects range from unauthenticated access to the Arkime backend to a CSRF route that can permanently delete captured traffic. This segment walks through what each flaw allows, which versions are affected, and where the fixes landed.

• Advisory ICSA-26-280-01 covers seven CVEs in CISA Malcolm, affecting versions up to and including v26.08.0.
• CVE-2026-107333, an RBAC path-normalization bypass, carries the highest score at CVSS v3 8.1 HIGH and was patched in v26.09.0.
• CVE-2026-107362, a server-side request forgery in the FilePond upload component, was also patched in v26.09.0.
• CVE-2026-107337 lets an attacker use CSRF against the kiosk Flask endpoint to run control.py --wipe, permanently deleting captured traffic; it was fixed in v26.08.0.
• CISA states no known public exploitation specifically targeting these vulnerabilities has been reported to date.

CISA flags seven flaws in Red Lion N-Tron 700 switches, including hard-coded credentials

CISA has updated its advisory on Red Lion Controls N-Tron 700 Series industrial switches, detailing seven vulnerabilities that range from default factory credentials to unauthenticated firmware uploads and a scriptable reboot loop. The devices are deployed worldwide across commercial facilities, communications, critical manufacturing and IT sectors. This segment sets out what is affected, the remediation path, and where the operational risk concentrates.

• Affected versions are N-Tron 700 Series firmware 3.11.0 and earlier and bootloader 2.0.6.1 and earlier; Red Lion recommends upgrading to version 3.11.1 or greater.
• CVE-2026-32645 concerns default factory administrative credentials that persist even after other administrator accounts are configured.
• CVE-2026-33367 allows SNMP to retrieve configuration files, modify accounts and settings, and initiate firmware or bootloader changes without any authentication.
• CVE-2026-28745, scored CVSS v4 9.3 (critical), involves passwords stored in the configuration file using weak encryption.
• CISA states no known public exploitation specifically targeting these vulnerabilities has been reported to it at this time.

NIST, NSA and CISA issue voluntary incident response guide for super intelligence training

Three US agencies have published joint guidance addressing what happens when advanced AI systems take actions that conflict with human oversight controls during training or evaluation. The document sets out voluntary practices for detecting, containing and recovering from such incidents, aimed at organisations developing cutting-edge, non-public systems.

• NIST, the NSA's Super Intelligence Security Center and CISA jointly published the guidance on October 16, 2026.
• The practices are voluntary and aimed particularly at pre-deployment, cutting-edge SI agents with reduced safeguards or other high-risk, non-public systems.
• An SI control incident is defined as uninstructed agent actions that conflict with or compromise policies, controls or security measures scoping the task and human oversight.
• The document outlines ten core practices covering access limitation, activity monitoring, evidence preservation and shutdown of undesired behavior, rebuilding from verified baselines, and reporting incidents and near-misses to relevant government agencies and affected parties.
• The guidance states organisations should test controls and validate containment before resuming SI agent activities.

CISA Links Integrity Technology Group to Global Hacking Campaign Targeting US Infrastructure

CISA, the FBI, NSA and cyber agencies from the UK, Australia, Canada, Japan, New Zealand and Spain jointly published a technical advisory on October 8, 2026 detailing tactics used by Integrity Technology Group-enabled threat actors against US critical infrastructure and global targets. It maps tools, exploited CVEs and MITRE ATT&CK techniques for network defenders.

• The advisory is co-authored by the FBI, CISA, NSA and cyber agencies from the UK, Australia, Canada, Japan, New Zealand and Spain, published October 8, 2026.
• Eight CVEs are listed as exploited, including CVE-2019-11510, CVE-2021-22205 and CVE-2021-3199.
• Threat actors use EBurst to conduct password spraying and guessing against Microsoft Exchange interfaces including ECP, EWS, OWA and PowerShell.
• Persistence is established via SoftEther VPN installers disguised with names such as conhost.exe or dllhost.exe, connecting to listed domains including hmbcloud[.]com and 98aiblog[.]com.
• The FBI observed threat actors restricting access to exfiltrated data to IP addresses from Xiamen, China, in some instances.

CISA details five flaws in energy-sector tools openPDC and openHistorian

CISA has published an advisory covering five vulnerabilities in Grid Protection Alliance's openPDC and openHistorian, software deployed worldwide in the energy sector for grid data collection and storage. The advisory sets out affected versions, remediation status and mitigation steps for operators running these systems, with Docker image deployments left without a vendor fix for several of the flaws.

• CISA's advisory lists five vulnerabilities affecting openPDC versions below 2.9.477/2.9.482 and openHistorian versions below 2.8.580/2.8.585.
• CVE-2026-100730 and CVE-2026-105278 each carry a CVSS 3.1 base score of 9.8, rated critical.
• Grid Protection Alliance has no fix planned for the Docker image and does not recommend its production use, per the advisory.
• A Modbus connection feature (CVE-2026-101022) lets an authenticated user target arbitrary internal network destinations, enabling internal network mapping.
• Shubham Raj of Causal Security reported the vulnerabilities to CISA, which released the advisory on 8 October 2026.

CISA Warns of Four Flaws in Satel Netco Design, Advises Upgrade to V2.1.7

CISA's advisory details four vulnerabilities affecting versions of Satel Netco Design prior to v2.1.7, deployed worldwide in the communications sector. The flaws range from stored cross-site scripting to path traversal issues that could allow file creation or modification. Compliance and security teams running this software should review patch status now.

• CISA released advisory ICSA-26-281-03 on October 8, 2026, covering Satel Netco Design versions prior to v2.1.7.
• CVE-2026-101024, a relative path traversal flaw in the export function, scores 8.8 on CVSS v3.1 and could allow arbitrary code execution under certain conditions.
• CVE-2026-105269 is a stored cross-site scripting vulnerability exploitable by an authenticated user with Network Operator privileges, scoring 6.8 on CVSS v3.1.
• Satel advises users to update to Satel Netco Design v2.1.7 to remediate all four vulnerabilities.
• Alex Williams of Pellera Technologies reported the vulnerabilities to CISA, which states no known public exploitation has occurred.

CISA flags critical flaws in dcm4che DICOM archive letting attackers delete and forge medical images

CISA's medical advisory covers six vulnerabilities in J4Care's dcm4chee-arc-light, a DICOM archive used in healthcare settings worldwide. The flaws range from missing authentication and authorization to denial-of-service conditions, with top CVSS v3 scores of 9.1. For anyone running medical imaging infrastructure, this is a patch-now item: the defaults ship insecure, and the vendor fix is already out.

• Six CVEs affect dcm4chee-arc-light 5.35.1; J4Care recommends upgrading to release 5.35.2 or later.
• In the default configuration, the archive and HL7 listener accept unauthenticated requests, enabling retrieval, forgery and patient-record reassignment.
• Top CVSS v3 base score is 9.1 (critical); CISA reports no known public exploitation to date.

CISA warns of path-traversal flaw in Thermo Fisher Torrent Suite; fix in 5.22

CISA's medical advisory ICSMA-26-288-01 covers a single path-traversal vulnerability in Thermo Fisher's Torrent Suite Software, used in the healthcare and public health sector worldwide. The segment runs through what the flaw allows, which versions are affected, the vendor's fix and the defensive measures CISA recommends for firms running the product.

• CVE-2026-107777 is a path-traversal flaw letting an authenticated attacker read arbitrary files on the Torrent Server accessible to the web service account.
• All Torrent Suite Software versions 5.18 and earlier are affected; Thermo Fisher recommends updating to version 5.22 or later.
• The vulnerability is scored CVSS v3.1 6.5 (medium) and CVSS v4 7.1 (high), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
• CISA reports no known public exploitation specifically targeting this vulnerability at this time.
• The product is deployed worldwide in the healthcare and public health sector.

CISA flags high-severity privilege-escalation flaw in Inductive Automation's Ignition platform

CISA has published an ICS advisory on a CVSS 8.8 authorization flaw in Inductive Automation's Ignition software, used across critical manufacturing, energy and IT sectors worldwide. This segment covers what the vulnerability allows, which versions are affected, the fixed builds, and the defensive measures CISA sets out for operators running the platform on control-system networks.

• CVE-2026-92817 allows an authenticated low-level user to escalate to Designer-level access and run arbitrary code on the Ignition Gateway.
• Affected builds are Ignition 8.1.0-8.1.54 and 8.3.0-8.3.8; fixes shipped in 8.3.9 (August 2025) and 8.1.55 (September 2026).
• CVSS v3.1 base score is 8.8 (HIGH); CISA reports no known public exploitation targeting the flaw at this time.

CISA adds exploited Ivanti Connect Secure zero-day to KEV catalog, urges immediate patching

CISA has flagged an actively exploited zero-day in Ivanti Connect Secure VPN appliances and added it to the Known Exploited Vulnerabilities catalog. The flaw enables unauthenticated remote command execution used for credential theft and data exfiltration. This segment covers the affected versions, why standard detection tooling falls short, and the recovery steps CISA endorses for suspected compromise.

• CVE-2026-104935 is a zero-day authentication bypass enabling remote, unauthenticated arbitrary command execution; added to CISA's KEV Catalog on Oct. 13, 2026.
• Affected: Ivanti Connect Secure 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior; version 22.8 reaches end of life Jan. 31, 2027.
• Ivanti's Integrity Checker Tool may miss exploitation because threat actor commands execute in memory; network and memory forensics required.

CISA flags unauthenticated video access in Swann SWIFI-SE2KIC cameras

CISA's October 13 advisory details three medium-severity vulnerabilities in Swann Communications' SWIFI-SE2KIC camera firmware. All stem from missing authentication and allow a local-network attacker to see video without logging in. The segment covers what is affected, the severity scoring, and why the mitigation list — rather than a patch — is the operative response for anyone running these devices.

• Three CWE-306 missing-authentication flaws in Swann SWIFI-SE2KIC firmware <=2.0.22 allow unauthenticated viewing of live video, snapshots and real-time streams.
• All rated medium (CVSS v3.1 base 6.2); CISA says the vulnerabilities are not remotely exploitable and reports no known public exploitation.
• Swann provided interim mitigations rather than a cited patch: secure the router/firewall, avoid internet-exposed RTSP, and use strong unique passwords.