The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Critical Manufacturing
Breach intelligence, attack campaigns, and threat reports targeting the Critical Manufacturing sector.
Explore Other Sectors
Critical Manufacturing Threat Reports
Critical lwIP Vulnerability Exposes Industrial Control Systems to Memory Corruption Attacks
A critical double free vulnerability (CVE-2026-91018) has been discovered in lwIP (Lightweight IP), a widely-used TCP/IP stack implementation found in embedded systems and IoT devices across critical infrastructure sectors including energy, healthcare, manufacturing, and transportation. The vulnerability affects lwIP API versions 2.0.1 through 2.2.1 and could allow attackers to crash systems, cause denial of service, corrupt memory, or potentially execute arbitrary code on vulnerable devices. With a CVSS score of 8.8, this flaw poses significant risks to industrial control systems and critical infrastructure worldwide, though exploitation requires adjacent network access. This vulnerability highlights the growing security challenges facing critical infrastructure as operational technology becomes increasingly connected and internet-accessible, while many organizations struggle with patching embedded systems that were never designed for regular security updates.
2 days ago
Kill Chain
Critical Authentication Flaw Exposes Schneider Electric PowerChute Systems to Bypass Attacks
Schneider Electric disclosed a critical vulnerability (CVE-2026-13348) in PowerChute Serial Shutdown versions 1.5 and earlier, affecting UPS management software used globally across critical infrastructure sectors including energy, manufacturing, and IT facilities. The vulnerability enables attackers to perform unlimited authentication attempts when redirect handling is disabled, potentially leading to unauthorized system access and operational disruption of power management systems. The flaw carries a CVSS score of 5.3 and has been addressed in version 1.6 with automatic service restart upon installation. This incident highlights the growing security risks in industrial control systems and power management infrastructure, particularly as organizations increasingly digitize their operational technology environments. With critical infrastructure under heightened scrutiny following recent nation-state campaigns targeting power grids and manufacturing facilities, vulnerabilities in widely-deployed UPS management systems represent significant attack surface expansion for threat actors seeking to disrupt industrial operations.
6 days ago
Kill Chain
Critical SAML Flaw in Siemens Mendix Enables Account Hijacking Across Industrial Systems
A critical authentication bypass vulnerability (CVE-2026-80465) was discovered in Siemens Mendix SAML modules across multiple versions, scoring 8.7 on the CVSS scale. The flaw stems from improper validation of SAML response signatures, allowing unauthenticated remote attackers to hijack user accounts and sessions in specific Single Sign-On (SSO) configurations. Affected versions include Mendix 9.24, 10, and 11 compatible modules, with the vulnerability impacting critical manufacturing and IT infrastructure worldwide. Siemens has released patches requiring immediate updates to versions 3.6.27 or 4.2.3 depending on the Mendix platform version. This incident highlights the growing trend of authentication protocol vulnerabilities targeting enterprise SSO systems, particularly as organizations increasingly rely on federated identity management for cloud and hybrid environments.
1 week ago
Kill Chain
Critical ASE2000 Vulnerabilities Expose Industrial Control Systems to XXE and TLS Bypass Attacks
Applied Systems Engineering's ASE2000 V2 Communications Test Set, used in critical infrastructure sectors including energy and manufacturing, contains two critical vulnerabilities affecting versions 2.25 through 2.37. CVE-2018-1285 involves XML External Entity (XXE) attacks through vulnerable Apache log4net configurations, while CVE-2026-18717 enables TLS certificate validation bypass. These vulnerabilities could allow attackers to read or write arbitrary files, intercept encrypted communications, and potentially compromise industrial control systems used worldwide. These vulnerabilities highlight the persistent challenge of securing industrial control systems, particularly as critical infrastructure faces increasing cyber threats and nation-state targeting, making immediate patching and network segmentation essential for operational security.
3 weeks ago
Kill Chain
Johnson Controls Fire Safety System Exposes Credentials in Memory: CVE-2026-27875 Analysis
Johnson Controls Simplex Incident Manager versions 2.01 and earlier contain a critical vulnerability (CVE-2026-27875) that stores user credentials including passwords and authentication tokens in unencrypted form within system memory. This cleartext storage vulnerability allows local attackers with low privileges to extract sensitive authentication data using memory-dumping tools, potentially leading to unauthorized access to fire safety systems and connected critical infrastructure. The vulnerability affects fire safety management systems deployed worldwide across critical manufacturing, commercial facilities, government services, transportation systems, and energy sectors. Johnson Controls has released patched version 2.01.01 to address this security flaw and recommends immediate upgrades along with enhanced access controls and endpoint monitoring. This incident highlights the growing concern over insecure credential management in industrial control systems as threat actors increasingly target OT environments. With fire safety systems being critical infrastructure components, credential exposure vulnerabilities pose significant risks to facility security and emergency response capabilities.
1 month ago
Kill Chain
Critical Vulnerability in Siemens Siveillance Video Management Servers: CVE-2026-3014
In August 2026, Siemens disclosed a critical vulnerability (CVE-2026-3014) in its Siveillance Video Management Servers, which could allow authenticated users with edit permissions to execute arbitrary code within the Management Server Service. This vulnerability affects versions V2023 R3 prior to V23.3.27, V2024 R1 prior to V24.1.16, and V2025 prior to V25.1.15. Siemens has released patches to address this issue and strongly recommends users update to the latest versions to mitigate potential risks. This incident underscores the ongoing challenges in securing critical infrastructure software, highlighting the importance of timely vulnerability management and the need for organizations to stay vigilant against potential exploitation of such vulnerabilities.
1 month ago
Kill Chain
Critical DoS Vulnerability in Siemens Desigo Controllers (CVE-2026-59693)
In August 2026, Siemens identified a denial-of-service (DoS) vulnerability in its Desigo DXR and PXC controllers, designated as CVE-2026-59693. This flaw allows attackers to send malformed BACnet packets, causing the devices to become unresponsive to BACnet queries. Recovery necessitates a device reset or reboot to restore normal functionality. Siemens has released updated firmware versions to address this issue and recommends that users update their devices promptly. This incident underscores the critical importance of securing building automation systems against network-based attacks. As these systems are integral to various critical infrastructure sectors, including commercial facilities, energy, healthcare, and transportation, ensuring their resilience against such vulnerabilities is paramount to maintaining operational continuity and safety.
1 month ago
Kill Chain
Critical Vulnerability in Siemens Mendix Runtime: CVE-2026-7891
In July 2026, a critical vulnerability (CVE-2026-7891) was identified in Siemens Mendix Runtime, affecting all versions. The issue stems from inadequate documentation regarding the special behavior of the System.User entity, leading developers to potentially configure overly permissive access rules. This misconfiguration can result in unauthorized access to sensitive user data and privilege escalation within Mendix applications. Siemens has advised developers to review and update their access rules based on the revised documentation to mitigate this risk. This incident underscores the importance of comprehensive documentation and secure configuration practices in application development. As similar vulnerabilities continue to emerge, organizations must prioritize regular security assessments and adhere to best practices to prevent unauthorized data exposure and maintain compliance with regulatory standards.
1 month ago
Kill Chain
Critical Vulnerabilities in Panduit IntraVUE Threaten Industrial Control Systems
In July 2026, multiple critical vulnerabilities were identified in Panduit IntraVUE versions up to 3.2.1a14. These vulnerabilities include plaintext storage of passwords, unintended proxy usage, exposure of sensitive system information, and inadequate encryption strength. Exploitation could allow attackers to manipulate industrial control devices remotely without physical access or specialized knowledge, posing significant risks to critical infrastructure sectors such as manufacturing, energy, and water systems. The discovery of these vulnerabilities underscores the ongoing challenges in securing industrial control systems. As cyber threats targeting critical infrastructure continue to evolve, organizations must prioritize timely vulnerability management and adopt robust security measures to mitigate potential risks.
2 months ago
Kill Chain
Critical Vulnerabilities Discovered in Johnson Controls' C-CURE 9000 and Victor Application Servers
In July 2026, multiple critical vulnerabilities were identified in Johnson Controls' C-CURE 9000 and Victor application servers, widely used in physical security management. These vulnerabilities, including CVE-2026-21655, CVE-2026-21653, and CVE-2026-34496, could allow unauthenticated attackers to execute arbitrary code, perform server-side request forgery, and escalate privileges, potentially compromising physical security systems and sensitive data. ([johnsoncontrols.com](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories?utm_source=openai)) The discovery of these vulnerabilities underscores the increasing targeting of critical infrastructure by cyber threats. Organizations must prioritize patching and implementing robust security measures to protect against such exploits, as the exploitation of these flaws could lead to significant operational disruptions and security breaches.
2 months ago
Kill Chain
Siemens RUGGEDCOM APE1808 Vulnerabilities: What You Need to Know
In July 2026, Siemens disclosed multiple vulnerabilities in its RUGGEDCOM APE1808 devices configured with Palo Alto Networks Virtual NGFW. These vulnerabilities include cross-site scripting (CVE-2026-0266), privilege escalation (CVE-2026-0272), and command injection (CVE-2026-0273). Exploitation could allow authenticated administrators to execute arbitrary commands with root privileges, potentially compromising system integrity. Siemens has advised customers to consult Palo Alto Networks' security notifications for workarounds and to contact customer support for patch information. This incident underscores the critical importance of timely vulnerability management in industrial control systems. Organizations should prioritize applying patches and implementing recommended security measures to mitigate risks associated with these vulnerabilities.
2 months ago
Kill Chain
Critical Security Flaws Discovered in Tycon Systems TPDIN-Monitor-WEB2 Devices
In July 2026, critical vulnerabilities were identified in Tycon Systems' TPDIN-Monitor-WEB2 devices, specifically affecting firmware version 2.3.9. The vulnerabilities, CVE-2026-61884 and CVE-2026-55985, allow unauthenticated remote attackers to bypass authentication and access sensitive credentials stored in cleartext. Exploitation of these flaws could lead to unauthorized control over device functions, disruption of connected infrastructure, and potential physical safety risks. ([windowsforum.com](https://windowsforum.com/threads/tycon-tpdin-monitor-web2-2-3-9-fix-critical-9-8-flaws.439865/?utm_source=openai)) This incident underscores the pressing need for robust security measures in industrial control systems, especially those deployed in critical manufacturing sectors worldwide. Organizations must prioritize timely firmware updates, network segmentation, and secure remote access protocols to mitigate such vulnerabilities.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports