Live 307 sources monitored São Paulo Washington London Frankfurt Dubai Hong Kong Sydney 7 regions
✦ RegulusGlobal regulatory broadcast network
CISA Advisories United States AI, Technology & Data Operational resilience ✓ 21 claims checked 18 Oct 2026

CISA flags six Eclipse Milo flaws exposing OPC UA servers to credential theft and denial of service

Regulus briefing
2:09 · CISA Advisories · 15 Oct 2026

CISA's October 15 industrial-control advisory covers multiple vulnerabilities in Eclipse Foundation's Eclipse Milo OPC UA server software. The flaws range from authorization bypasses to a password-recovery padding oracle and several denial-of-service conditions. For operators in chemical, critical manufacturing, energy and water sectors, the practical sting is that affected 0.6.x deployments cannot be patched in place and must be migrated to 1.1.5 or later.

  • CISA advisory ICSA-26-288-01, released October 15, 2026, covers vulnerabilities in Eclipse Milo versions 0.6.0 through 1.1.4.
  • CVE-2026-60007, a padding-oracle flaw enabling password recovery, carries a CVSS v4 base score of 9.1, rated critical.
  • The Eclipse Foundation recommends upgrading to Eclipse Milo 1.1.5; there are no 0.6.x releases with the fixes, requiring migration.
  • Successful exploitation could delete protected data, recover credentials and impersonate users, or stop the server responding to all clients.
  • Affected deployments span the chemical, critical manufacturing, energy, and water and wastewater sectors worldwide.

Executive summary

CISA published advisory ICSA-26-288-01 on October 15, 2026, covering vulnerabilities in Eclipse Foundation's Eclipse Milo, an OPC UA server implementation. The affected software is headquartered in Belgium and deployed worldwide across the chemical, critical manufacturing, energy, and water and wastewater…

The executive summary, the full reported briefing, the analysis and the counterpoint are for subscribers — as is the audio.

You are not charged for 3 days and you can cancel at any time. Already subscribe? Sign in to hear this and everything else published today.

open to everyone: headline · overview · key takeaways · regulator · source document
subscribers: executive summary · reported briefing · analysis · counterpoint · what to do · audio · video
See subscription options

Source documents

https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-01
Published by CISA Advisories · 15 Oct 2026
Read by Regulus 15 Oct 2026 at 18:05 UTC
21 factual claims checked against this document · 0 unsupported
Cited and linked; extract quoted under fair dealing

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.