Find what you’re looking for
Browse everything
6,892 results in Threat Reports
ABB Advant Master Online Builder Vulnerability: CVE-2025-13162
In June 2026, ABB identified a vulnerability (CVE-2025-13162) in its Advant Master Online Builder software, affecting Control Builder A versions up to 1.4/4 and 800xA for Advant Master versions up to 6.2.0-1. The flaw, an uncontrolled search path element, could allow unauthorized code execution if exploited by an attacker with local access. ABB promptly released updates to remediate the issue and advised customers to upgrade to the latest versions to maintain system integrity. This incident underscores the critical importance of timely software updates and vigilant access control in industrial control systems. As cyber threats targeting operational technology environments continue to evolve, organizations must prioritize proactive vulnerability management to safeguard critical infrastructure.
Critical Vulnerability in ABB Ability Edgenius: Immediate Action Required
In June 2026, ABB disclosed a critical vulnerability (CVE-2026-31431) in its Ability Edgenius platform, stemming from a flaw in the Linux kernel's cryptographic subsystem. This vulnerability allows locally authenticated users or compromised container workloads to escalate privileges to root, granting full control over affected systems. The issue impacts Edgenius versions 3.2.0.0 to 3.2.4.0 across various deployments, including Edgenius Gateway and Server models. ABB has released version 3.2.4.1 to address this vulnerability and recommends immediate updates. ([library.e.abb.com](https://library.e.abb.com/public/7fecf60652de4f8389c65dd3892ad4f0/7PAA024620_A_en%20ABB%20Ability%20Edgenius.pdf?x-sign=CTBqG4CeWrSNfPCZ4%2Bpgxw0qQeqB4l5P1o8dYUUq%2BXJ5ZJyaTAO4yFUHSWMPvOXH&utm_source=openai)) The 'Copy Fail' vulnerability has been actively exploited in the wild, with reports of attackers leveraging it to gain unauthorized root access in cloud environments. Given its widespread impact across multiple Linux distributions and the availability of proof-of-concept exploits, organizations are urged to prioritize patching to mitigate potential security breaches. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/05/01/cve-2026-31431-copy-fail-vulnerability-enables-linux-root-privilege-escalation/?utm_source=openai))
Critical Vulnerabilities in ABB T-MAC Plus Threaten Industrial Control Systems
In June 2026, ABB disclosed multiple critical vulnerabilities in its T-MAC Plus system, versions 4.0-24, affecting industrial control systems worldwide. The identified vulnerabilities include CVE-2025-14771 (file disclosure), CVE-2025-14772 (authorization bypass), CVE-2025-14773 (stored cross-site scripting), and CVE-2025-14774 (denial-of-service via insecure network protocol). Exploitation of these flaws could lead to unauthorized access, data exfiltration, and disruption of critical manufacturing operations. ABB has released version 4.0-25 to address these issues and recommends immediate updates. ([library.e.abb.com](https://library.e.abb.com/public/fdc6cdcbc5a14784a640c5f346bb5d5d/9AKK108472A7840_en_A_Vulnerabilities%20in%20T-MAC%20Plus.pdf?x-sign=9BMyAW9U5kVKNEtaWjhiCwtjt5iWMxiwQl8QdxbPx1vwCqNhlozXxFzbtRzs7ZQN&utm_source=openai)) The disclosure underscores the persistent threat landscape targeting industrial control systems, emphasizing the need for robust cybersecurity measures. Organizations are urged to assess their systems for similar vulnerabilities and implement comprehensive security protocols to safeguard against potential exploits.
Critical Security Alert: Unauthenticated Remote Access Vulnerability in Rockwell Automation 1715-AENTR EtherNet/IP Adapter
In July 2026, a critical vulnerability (CVE-2026-10577) was identified in Rockwell Automation's 1715-AENTR EtherNet/IP Adapter, exposing a network-accessible debug port lacking proper authentication controls. This flaw allows unauthenticated remote attackers to execute intrusive command-line interface commands, including reading or deleting files, stopping tasks, modifying memory, and altering I/O states, thereby compromising the device's confidentiality, integrity, and availability. The vulnerability affects versions up to and including 3.003. Rockwell Automation has released version 3.011 to address this issue. Organizations utilizing these adapters are urged to update promptly to mitigate potential risks. This incident underscores the critical importance of securing industrial control systems against unauthorized access, especially as such vulnerabilities can lead to significant operational disruptions. The exposure of critical functions without authentication highlights the need for stringent security measures in industrial environments to prevent potential exploitation by malicious actors.
ESET Uncovers Vulnerable Microsoft-Signed UEFI Shims Allowing Secure Boot Bypass
In July 2026, ESET researchers identified 11 outdated, Microsoft-signed UEFI shim bootloaders vulnerable to Secure Boot bypasses. These shims, versions 0.9 and below, allow attackers to execute untrusted code during system boot, potentially deploying malicious UEFI bootkits. Exploitation isn't limited to systems with the affected software installed; attackers can introduce these vulnerable shims to any UEFI system trusting the Microsoft Corporation UEFI CA 2011 certificate. Microsoft addressed this by revoking the vulnerable shims in its June 9, 2026 Patch Tuesday update. ([globenewswire.com](https://www.globenewswire.com/news-release/2026/07/14/3326630/0/en/eset-research-discovers-vulnerable-uefi-shims-undermining-devices-secure-boot.html?utm_source=openai)) This incident underscores the critical need for organizations to regularly update and monitor bootloader components. The discovery highlights the risks associated with outdated firmware and the importance of timely patch management to maintain system integrity.
Critical RabbitMQ Vulnerabilities Expose OAuth Secrets - CVE-2026-57219
In July 2026, two critical vulnerabilities were identified in RabbitMQ, a widely used open-source message broker. The most severe, CVE-2026-57219, allowed unauthenticated attackers to access the broker's OAuth client secret via an obsolete management API endpoint, potentially enabling full control over the messaging infrastructure. The second flaw, CVE-2026-57221, permitted authenticated users with no privileges to view metadata of other tenants' queues and exchanges, risking exposure of sensitive business information. Both vulnerabilities have been patched in RabbitMQ versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6. Organizations are urged to update their systems and rotate any exposed OAuth secrets to mitigate potential risks. ([scworld.com](https://www.scworld.com/news/rabbitmq-fixes-flaw-that-allowed-broker-takeover-via-oauth-secret-disclosure?utm_source=openai)) These incidents underscore the critical importance of securing management interfaces and promptly addressing deprecated endpoints to prevent unauthorized access and data exposure. The widespread use of RabbitMQ amplifies the potential impact, highlighting the need for vigilant security practices in managing messaging infrastructures.
Protecting SaaS Applications from ShinyHunters' OAuth Exploits
Between mid-2025 and mid-2026, the cybercriminal group ShinyHunters executed a series of sophisticated attacks targeting SaaS-based applications, notably Salesforce. Utilizing techniques such as voice phishing (vishing), supply chain compromises, and exploiting misconfigured guest access, they abused trusted OAuth relationships to gain unauthorized access, exfiltrate data, and establish persistent footholds within organizations. These methods allowed them to inherit user and application privileges, enabling extensive enumeration and querying of customer relationship management (CRM) records while evading traditional authentication detections. The campaigns impacted multiple industries, including retail, education, and manufacturing, underscoring the critical need for vigilant monitoring of OAuth-connected applications, thorough validation of third-party integrations, and stringent review of guest access configurations. The relevance of this incident is heightened by the increasing prevalence of similar tactics employed by threat actors to exploit OAuth mechanisms and third-party integrations. Organizations must recognize the evolving threat landscape where attackers leverage trusted relationships and social engineering to bypass conventional security measures. This trend emphasizes the urgency for enhanced detection capabilities, improved visibility into connected applications, and the implementation of robust security practices to safeguard against such sophisticated attacks.
Russian FSB Exploits Cisco Vulnerabilities in Critical Infrastructure Attacks
In July 2026, a joint cybersecurity advisory from the United States and 12 other nations highlighted ongoing cyber intrusions by Russian state-sponsored hackers, specifically the FSB's Center 16, also known as Berserk Bear and Static Tundra. These actors have been exploiting vulnerabilities in Cisco networking devices, notably CVE-2008-4128 and CVE-2018-0171, to infiltrate critical infrastructure sectors such as defense, communications, energy, finance, government, and healthcare. The attackers leverage default or weak passwords and unpatched systems to gain unauthorized access, conduct reconnaissance, and potentially disrupt operations. This incident underscores the persistent threat posed by nation-state actors targeting outdated and misconfigured network devices. Organizations are urged to implement robust security measures, including disabling vulnerable features like Cisco's Smart Install, enforcing strong authentication protocols, and regularly updating systems to mitigate such risks.
EU and UK Sanction Russian Entities Over Cyberespionage Campaign
In July 2026, the European Union and the United Kingdom imposed coordinated sanctions on Russian military intelligence officers, hackers, and private companies in response to a prolonged cyberespionage campaign attributed to Russian actors. The EU targeted nine individuals and four entities, while the UK sanctioned 24 individuals and organizations. These sanctions, including asset freezes and travel bans, were directed at actors linked to Russia's FSB and GRU intelligence agencies, accused of conducting cyber operations targeting governments and critical infrastructure since 2010. Key affected countries include France, Germany, Poland, the Netherlands, and Finland, with specific incidents such as the sabotage of Polish railway infrastructure highlighted. ([apnews.com](https://apnews.com/article/1d3c542e1409b54a10856eacad18b7ca?utm_source=openai)) This incident underscores the escalating threat of state-sponsored cyberattacks on critical infrastructure and governmental networks. The coordinated response by the EU and UK reflects a growing recognition of the need for unified action against cyber threats, emphasizing the importance of robust cybersecurity measures and international cooperation to safeguard national security and public services.
EU and UK Sanction Russian GRU Hackers Over Cyberattacks
In July 2026, the European Union and the United Kingdom jointly imposed sanctions on Russian military intelligence officers and associated entities for orchestrating extensive cyberattacks across Europe. These operations, attributed to the GRU and FSB's 16th Centre, targeted government networks and critical infrastructure in countries including France, Germany, Poland, and Finland. Notably, the Turla hacking group, linked to the FSB, attempted to disrupt Poland's energy grid, potentially affecting 500,000 residents during winter. The sanctions encompass asset freezes and travel bans on individuals and entities involved in these cyberespionage activities. This incident underscores the escalating threat of state-sponsored cyberattacks on critical infrastructure, highlighting the need for enhanced cybersecurity measures and international cooperation to deter such activities. The coordinated response by the EU and UK reflects a growing consensus on the importance of addressing cyber threats through unified diplomatic and legal actions.
US and Allies Issue Joint Advisory on Russian Cyber Threats to Critical Infrastructure
In July 2026, cybersecurity agencies from the United States and eight allied nations issued a joint advisory warning that Russian state-sponsored hackers, specifically FSB Center 16 (also known as Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and Static Tundra), are actively targeting vulnerable and poorly configured routers to infiltrate critical infrastructure networks. These actors exploit default or weak SNMP authentication strings and known vulnerabilities, such as CVE-2018-0171 in Cisco's Smart Install feature, to gain unauthorized access, exfiltrate configuration files, and conduct reconnaissance within victim networks. The sectors most at risk include energy, communications, defense industrial base, healthcare, financial services, and government services. This incident underscores the persistent threat posed by nation-state actors to critical infrastructure, highlighting the importance of proactive cybersecurity measures. Organizations are urged to upgrade to SNMPv3, disable unnecessary services like Cisco Smart Install, enforce strong unique passwords, block TFTP and SNMP traffic at edge firewalls, update software and firmware, and replace end-of-life devices to mitigate such risks.
UK Authorities Charge Five in Russian Coms Caller ID Spoofing Case
In July 2026, UK authorities charged five individuals in connection with Russian Coms, a caller ID spoofing platform implicated in over 1.8 million scam calls since its inception in 2020. The platform enabled criminals to impersonate trusted entities, leading to financial losses estimated in the tens of millions and affecting approximately 170,000 victims. The National Crime Agency (NCA) had previously dismantled Russian Coms in March 2024, arresting key figures believed to be its developers and administrators. The recent charges underscore the ongoing efforts to hold accountable those involved in facilitating large-scale fraud operations. This incident highlights the persistent threat posed by sophisticated social engineering tactics and the critical need for robust cybersecurity measures to protect individuals and organizations from such fraudulent schemes.