The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Chemicals
Breach intelligence, attack campaigns, and threat reports targeting the Chemicals sector.
Explore Other Sectors
Chemicals Threat Reports
Critical Privilege Escalation Flaw Exposes ABB Industrial Edge Computing Platforms
ABB disclosed CVE-2026-31431 (Copy Fail), a critical Linux kernel vulnerability affecting ABB Ability Edgenius edge computing platforms versions 3.2.0.0 through 3.2.4.1. The vulnerability, with a CVSS score of 7.8, stems from incorrect resource transfer in the Linux kernel's cryptographic subsystem and allows locally authenticated users or compromised container workloads to escalate privileges to root access. Once exploited, attackers gain complete system control over industrial edge computing infrastructure deployed globally across critical manufacturing, energy, water, and chemical sectors. ABB has released version 3.2.4.1 to address the vulnerability and recommends immediate patching. This incident highlights the growing attack surface of edge computing in industrial environments, where kernel-level vulnerabilities can provide attackers with deep system access to compromise operational technology networks and critical infrastructure control systems.
6 days ago
Kill Chain
CVE-2025-6625: Critical FTP Vulnerability in Schneider Electric Industrial Controllers
Schneider Electric disclosed CVE-2025-6625, a high-severity improper input validation vulnerability affecting Modicon M340 controllers and communication modules used across critical infrastructure sectors including energy, chemical, and water systems. The vulnerability allows attackers to send crafted FTP commands to cause denial of service attacks, potentially disrupting industrial control systems. Multiple product versions are affected, with firmware updates available for some modules while others await remediation. The vulnerability carries a CVSS score of 7.5 and impacts globally deployed industrial automation systems. This incident highlights the ongoing security challenges facing industrial control systems as threat actors increasingly target operational technology environments. With critical infrastructure under heightened scrutiny following recent nation-state campaigns, vulnerabilities in widely-deployed industrial controllers represent significant risk amplification across interconnected systems.
6 days ago
Kill Chain
Critical Buffer Overflow Vulnerability CVE-2026-78012 Threatens Industrial Control Systems
In September 2026, CISA disclosed CVE-2026-78012, a critical stack-based buffer overflow vulnerability in Pyramid Solutions NetStaX EtherNet/IP Stack affecting versions prior to 5.6.1. The vulnerability allows attackers to send large Class 3 explicit-message requests that exceed application-side receive buffers without generating error warnings, potentially leading to memory corruption, device crashes, or remote code execution. With a CVSS score of 9.8, this flaw impacts multiple industrial control systems across critical infrastructure sectors including manufacturing, energy, water treatment, and chemical facilities worldwide. The vulnerability represents a significant threat to operational technology environments where these industrial communication stacks are widely deployed. This incident highlights the growing cybersecurity risks facing industrial control systems as OT networks become increasingly connected and targeted by sophisticated threat actors, making secure industrial communication protocols and robust buffer management critical for protecting critical infrastructure.
2 weeks ago
Kill Chain
CVE-2026-77477 Exposes Critical Privilege Escalation Risk in OPC UA Infrastructure
CVE-2026-77477 affects OPCFoundation OPC UA LocalDiscoveryServer (LDS) installations prior to version 1.04.420, allowing attackers to intercept high-privilege console windows during installation. The vulnerability enables execution of arbitrary commands with elevated privileges when an attacker has physical or remote desktop access during the installation process. This impacts critical infrastructure sectors including chemical, energy, food and agriculture, and manufacturing worldwide, with a CVSS score of 4.6 (Medium severity). This vulnerability highlights the growing security challenges in industrial control systems and OT environments, where installation-time privilege escalation can provide attackers with persistent access to critical infrastructure components.
2 weeks ago
Kill Chain
Critical Vulnerabilities Expose Rockwell Automation Industrial Systems to Remote Attacks
In September 2026, CISA disclosed critical vulnerabilities in Rockwell Automation's FactoryTalk Historian Machine Edition affecting Series B 5.202 and Series C 7.101. CVE-2025-12768, with a CVSS score of 8.0, enables remote code execution through an out-of-bounds write condition exploitable by attackers with low-level authentication. CVE-2026-12661 allows denial-of-service attacks via stack-based buffer overflows when crafted requests are sent to the web interface, potentially crashing industrial systems. These vulnerabilities impact critical infrastructure sectors including chemical manufacturing, healthcare, and water systems worldwide. The disclosure emphasizes the growing threat landscape targeting industrial control systems and operational technology environments. Similar buffer overflow vulnerabilities in ICS components have been increasingly exploited by nation-state actors and ransomware groups to disrupt critical infrastructure operations.
3 weeks ago
Kill Chain
Critical ASE2000 Vulnerabilities Expose Industrial Control Systems to XXE and TLS Bypass Attacks
Applied Systems Engineering's ASE2000 V2 Communications Test Set, used in critical infrastructure sectors including energy and manufacturing, contains two critical vulnerabilities affecting versions 2.25 through 2.37. CVE-2018-1285 involves XML External Entity (XXE) attacks through vulnerable Apache log4net configurations, while CVE-2026-18717 enables TLS certificate validation bypass. These vulnerabilities could allow attackers to read or write arbitrary files, intercept encrypted communications, and potentially compromise industrial control systems used worldwide. These vulnerabilities highlight the persistent challenge of securing industrial control systems, particularly as critical infrastructure faces increasing cyber threats and nation-state targeting, making immediate patching and network segmentation essential for operational security.
3 weeks ago
Kill Chain
Critical Siemens SIMATIC IoT2050 Vulnerability Exposes Industrial Systems to Remote Takeover
In August 2026, CISA disclosed a critical vulnerability (CVE-2026-58115) in Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. The vulnerability stems from missing authentication on the Node-RED HTTP interface, allowing unauthenticated remote attackers to create malicious flows and execute arbitrary code with maximum privileges. With a CVSS score of 10.0, this vulnerability affects industrial control systems deployed globally across chemical, manufacturing, energy, and transportation sectors. Siemens has released version 4.3.4.1 to address the issue and strongly recommends immediate updates. This disclosure highlights the growing security risks in Industrial IoT environments as operational technology increasingly integrates with network-accessible programming interfaces. The vulnerability represents a broader trend of critical authentication bypasses in industrial control systems that could enable devastating attacks on critical infrastructure.
4 weeks ago
Kill Chain
AI-Powered Cyber Attacks Target Critical Infrastructure: The New Age of Autonomous Threats
In August 2026, the U.S. government warned of an active threat targeting critical infrastructure organizations using AI-generated exploit scripts against Siemens S7 Series Programmable Logic Controllers (PLCs). The attackers leveraged internet scanning services like Censys and ZoomEye to identify exposed PLCs running outdated software, then deployed custom Python scripts incorporating open-source automation libraries to gain unauthorized access to industrial control systems across Critical Manufacturing, Energy, Water and Wastewater Systems, Chemical, Food and Agriculture, and Commercial Facilities sectors. Concurrently, a separate multi-agent autonomous AI attack framework targeted Taiwan government entities in July 2026, demonstrating the evolution of AI-powered cyber operations. The Taiwan incident involved eight parallel AI sub-agents that performed reconnaissance, credential cracking, and data exfiltration, successfully compromising over 2,564 personnel records and establishing persistent backdoors across government infrastructure. These incidents mark a significant evolution in offensive capabilities, with AI assistance lowering technical barriers for Industrial Control System attacks and dramatically reducing the cost and expertise required for sophisticated cyber operations.
1 month ago
Kill Chain
Critical Vulnerabilities in Siemens S7 PLCs Discovered in 2026
In 2026, Siemens SIMATIC S7 Series PLCs were found to have multiple critical vulnerabilities, including cross-site scripting (XSS) flaws in their web servers and denial-of-service (DoS) issues in the S7-PLCSIM Advanced software. These vulnerabilities could allow attackers to execute arbitrary code or disrupt industrial processes. Siemens has released updates and advisories to address these issues, urging users to apply patches and implement recommended mitigations promptly. The discovery of these vulnerabilities underscores the ongoing risks to industrial control systems, especially as threat actors increasingly target critical infrastructure. Organizations must remain vigilant, regularly update their systems, and adhere to cybersecurity best practices to protect against potential exploits.
1 month ago
Kill Chain
Immediate Action Required: SAP Commerce Cloud CVE-2026-58231 Exploited Days After Patch Release
In August 2026, SAP Commerce Cloud was found to have a critical vulnerability, CVE-2026-58231, rated 10.0 on the CVSS scale. This flaw allows unauthenticated attackers to exploit default authentication clients and submit specially crafted inputs to functions lacking sufficient validation, potentially leading to arbitrary code execution and compromising internal components. Exploitation attempts were detected just three days after the patch release, indicating rapid targeting by threat actors. The swift exploitation of CVE-2026-58231 underscores the increasing speed at which cyber adversaries are capitalizing on newly disclosed vulnerabilities. Organizations must prioritize timely patching and implement robust security measures to mitigate risks associated with such critical flaws.
1 month ago
Kill Chain
Nine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance Payments
Since 2017, a sophisticated fraud campaign has been targeting international firms by creating counterfeit websites that closely mimic those of major Russian companies in sectors such as fertilizer manufacturing, petrochemicals, metallurgy, logistics, and banking. These fraudulent sites, available in multiple languages including English, French, Arabic, and Russian, are designed to deceive businesses into making advance payments for non-existent goods. The attackers employ tactics like cold calls, phishing emails, and fake corporate websites to initiate contact, eventually providing falsified business documents with fraudulent banking details. One notable incident in April 2025 involved an Azerbaijani company losing $150,000 through such a scheme. This prolonged campaign underscores the evolving nature of cyber fraud, highlighting the need for businesses to remain vigilant against increasingly sophisticated social engineering tactics. The use of multilingual fake websites and the recruitment of unwitting sales representatives indicate a high level of organization and adaptability among cybercriminals, posing significant risks to international trade and business operations.
1 month ago
Kill Chain
Critical Vulnerability in Rockwell Automation ThinManager: CVE-2026-11917
In July 2026, a critical path traversal vulnerability (CVE-2026-11917) was identified in Rockwell Automation's ThinManager software, affecting versions 13.0.0 through 14.0.2. This flaw allows authenticated attackers to write arbitrary files to restricted system directories outside the application's intended directory, potentially leading to unauthorized access, data breaches, or manipulation of critical system files. Rockwell Automation has released patches to address this issue, and users are strongly advised to upgrade to the corrected versions immediately. ([rockwellautomation.com](https://www.rockwellautomation.com/es-es/trust-center/security-advisories/advisory.SD1782.html?utm_source=openai)) This incident underscores the importance of robust access controls and input validation in industrial control systems. The vulnerability's exploitation could lead to complete system compromise, data exfiltration, or disruption of industrial control processes that ThinManager typically supports in manufacturing and automation environments. ([vuldb.com](https://vuldb.com/cve/CVE-2026-11917?utm_source=openai))
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports