Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Critical Manufacturing

Breach intelligence, attack campaigns, and threat reports targeting the Critical Manufacturing sector.

68 threat reports
Page 1 of 6
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Critical Manufacturing Threat Reports

Showing 1–12 / 68 reports
Moxa AIG-302 ThingsPro Edge: Two ICS Vulnerabilities Put OT Cryptographic Keys and API Secrets at Risk
CISA Alert: Moxa AIG-302 ThingsPro Edge Firmware Exposes Hard-Coded Keys and Missing Authorization Flaws in Critical ICS Deployments
Oil/Energy/Solar/Greentech2 weeks ago

Moxa AIG-302 ThingsPro Edge: Two ICS Vulnerabilities Put OT Cryptographic Keys and API Secrets at Risk

On October 20, 2026, CISA published ICS Advisory ICSA-26-293-03 disclosing two critical vulnerabilities in the Moxa AIG-302 ThingsPro Edge industrial IoT gateway running firmware version 1.4.0 and earlier. CVE-2026-109812 (CVSS 6.8) exposes a missing authorization flaw in the internal API endpoint /api/v1/secrets/, allowing a privileged but low-trust attacker with adjacent network access to retrieve cryptographic key material and sensitive configuration data. CVE-2026-109813 (CVSS 8.1) reveals a hard-coded cryptographic key embedded in /usr/bin/sysman, enabling an unauthenticated adjacent-network attacker to compromise both the confidentiality and integrity of all device communications. Both flaws are addressed in firmware v1.4.1, released by Moxa under security advisory MPSA-262560. Affected deployments span critical manufacturing, energy, and water and wastewater sectors worldwide. These vulnerabilities arrive amid intensifying scrutiny of OT/ICS supply-chain security, where hard-coded credentials and weak access controls in edge devices continue to serve as reliable pivot points for nation-state and ransomware actors targeting industrial infrastructure. The Cybersecurity and Infrastructure Security Agency's active advisory cadence signals growing regulatory urgency around ICS device hygiene and adjacent-network threat surfaces.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical Vulnerabilities Expose Red Lion Controls Industrial Switches to Complete Compromise
Critical Vulnerabilities Expose Red Lion Controls Industrial Switches to Complete Compromise
Critical Manufacturing4 weeks ago

Critical Vulnerabilities Expose Red Lion Controls Industrial Switches to Complete Compromise

Red Lion Controls N-Tron 700 Series industrial network switches contain seven critical vulnerabilities (CVE-2026-32645 through CVE-2026-33272) discovered in October 2026. The vulnerabilities include hardcoded credentials, plaintext password storage, unauthenticated SNMP access, and missing firmware integrity checks. Attackers can gain administrative access, extract configuration files, push malicious firmware, and cause denial-of-service conditions through automated rebooting. These switches are deployed worldwide across critical infrastructure sectors including manufacturing, communications, and commercial facilities. This incident highlights the persistent security challenges in industrial control systems, particularly as critical infrastructure becomes increasingly connected. The combination of authentication bypasses and configuration exposure creates significant risk for operational technology environments where network switches serve as foundational infrastructure components.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical lwIP Vulnerability Exposes Industrial Control Systems to Memory Corruption Attacks
Critical lwIP Vulnerability Exposes Industrial Control Systems to Memory Corruption Attacks
Critical Manufacturing1 month ago

Critical lwIP Vulnerability Exposes Industrial Control Systems to Memory Corruption Attacks

A critical double free vulnerability (CVE-2026-91018) has been discovered in lwIP (Lightweight IP), a widely-used TCP/IP stack implementation found in embedded systems and IoT devices across critical infrastructure sectors including energy, healthcare, manufacturing, and transportation. The vulnerability affects lwIP API versions 2.0.1 through 2.2.1 and could allow attackers to crash systems, cause denial of service, corrupt memory, or potentially execute arbitrary code on vulnerable devices. With a CVSS score of 8.8, this flaw poses significant risks to industrial control systems and critical infrastructure worldwide, though exploitation requires adjacent network access. This vulnerability highlights the growing security challenges facing critical infrastructure as operational technology becomes increasingly connected and internet-accessible, while many organizations struggle with patching embedded systems that were never designed for regular security updates.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
Critical Authentication Flaw Exposes Schneider Electric PowerChute Systems to Bypass Attacks
Critical Authentication Flaw Exposes Schneider Electric PowerChute Systems to Bypass Attacks
Utilities1 month ago

Critical Authentication Flaw Exposes Schneider Electric PowerChute Systems to Bypass Attacks

Schneider Electric disclosed a critical vulnerability (CVE-2026-13348) in PowerChute Serial Shutdown versions 1.5 and earlier, affecting UPS management software used globally across critical infrastructure sectors including energy, manufacturing, and IT facilities. The vulnerability enables attackers to perform unlimited authentication attempts when redirect handling is disabled, potentially leading to unauthorized system access and operational disruption of power management systems. The flaw carries a CVSS score of 5.3 and has been addressed in version 1.6 with automatic service restart upon installation. This incident highlights the growing security risks in industrial control systems and power management infrastructure, particularly as organizations increasingly digitize their operational technology environments. With critical infrastructure under heightened scrutiny following recent nation-state campaigns targeting power grids and manufacturing facilities, vulnerabilities in widely-deployed UPS management systems represent significant attack surface expansion for threat actors seeking to disrupt industrial operations.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical SAML Flaw in Siemens Mendix Enables Account Hijacking Across Industrial Systems
Computer Software/Engineering1 month ago

Critical SAML Flaw in Siemens Mendix Enables Account Hijacking Across Industrial Systems

A critical authentication bypass vulnerability (CVE-2026-80465) was discovered in Siemens Mendix SAML modules across multiple versions, scoring 8.7 on the CVSS scale. The flaw stems from improper validation of SAML response signatures, allowing unauthenticated remote attackers to hijack user accounts and sessions in specific Single Sign-On (SSO) configurations. Affected versions include Mendix 9.24, 10, and 11 compatible modules, with the vulnerability impacting critical manufacturing and IT infrastructure worldwide. Siemens has released patches requiring immediate updates to versions 3.6.27 or 4.2.3 depending on the Mendix platform version. This incident highlights the growing trend of authentication protocol vulnerabilities targeting enterprise SSO systems, particularly as organizations increasingly rely on federated identity management for cloud and hybrid environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Critical ASE2000 Vulnerabilities Expose Industrial Control Systems to XXE and TLS Bypass Attacks
Utilities2 months ago

Critical ASE2000 Vulnerabilities Expose Industrial Control Systems to XXE and TLS Bypass Attacks

Applied Systems Engineering's ASE2000 V2 Communications Test Set, used in critical infrastructure sectors including energy and manufacturing, contains two critical vulnerabilities affecting versions 2.25 through 2.37. CVE-2018-1285 involves XML External Entity (XXE) attacks through vulnerable Apache log4net configurations, while CVE-2026-18717 enables TLS certificate validation bypass. These vulnerabilities could allow attackers to read or write arbitrary files, intercept encrypted communications, and potentially compromise industrial control systems used worldwide. These vulnerabilities highlight the persistent challenge of securing industrial control systems, particularly as critical infrastructure faces increasing cyber threats and nation-state targeting, making immediate patching and network segmentation essential for operational security.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Johnson Controls Fire Safety System Exposes Credentials in Memory: CVE-2026-27875 Analysis
Critical Manufacturing2 months ago

Johnson Controls Fire Safety System Exposes Credentials in Memory: CVE-2026-27875 Analysis

Johnson Controls Simplex Incident Manager versions 2.01 and earlier contain a critical vulnerability (CVE-2026-27875) that stores user credentials including passwords and authentication tokens in unencrypted form within system memory. This cleartext storage vulnerability allows local attackers with low privileges to extract sensitive authentication data using memory-dumping tools, potentially leading to unauthorized access to fire safety systems and connected critical infrastructure. The vulnerability affects fire safety management systems deployed worldwide across critical manufacturing, commercial facilities, government services, transportation systems, and energy sectors. Johnson Controls has released patched version 2.01.01 to address this security flaw and recommends immediate upgrades along with enhanced access controls and endpoint monitoring. This incident highlights the growing concern over insecure credential management in industrial control systems as threat actors increasingly target OT environments. With fire safety systems being critical infrastructure components, credential exposure vulnerabilities pose significant risks to facility security and emergency response capabilities.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Vulnerability in Siemens Siveillance Video Management Servers: CVE-2026-3014
Security/Investigations2 months ago

Critical Vulnerability in Siemens Siveillance Video Management Servers: CVE-2026-3014

In August 2026, Siemens disclosed a critical vulnerability (CVE-2026-3014) in its Siveillance Video Management Servers, which could allow authenticated users with edit permissions to execute arbitrary code within the Management Server Service. This vulnerability affects versions V2023 R3 prior to V23.3.27, V2024 R1 prior to V24.1.16, and V2025 prior to V25.1.15. Siemens has released patches to address this issue and strongly recommends users update to the latest versions to mitigate potential risks. This incident underscores the ongoing challenges in securing critical infrastructure software, highlighting the importance of timely vulnerability management and the need for organizations to stay vigilant against potential exploitation of such vulnerabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical DoS Vulnerability in Siemens Desigo Controllers (CVE-2026-59693)
Utilities2 months ago

Critical DoS Vulnerability in Siemens Desigo Controllers (CVE-2026-59693)

In August 2026, Siemens identified a denial-of-service (DoS) vulnerability in its Desigo DXR and PXC controllers, designated as CVE-2026-59693. This flaw allows attackers to send malformed BACnet packets, causing the devices to become unresponsive to BACnet queries. Recovery necessitates a device reset or reboot to restore normal functionality. Siemens has released updated firmware versions to address this issue and recommends that users update their devices promptly. This incident underscores the critical importance of securing building automation systems against network-based attacks. As these systems are integral to various critical infrastructure sectors, including commercial facilities, energy, healthcare, and transportation, ensuring their resilience against such vulnerabilities is paramount to maintaining operational continuity and safety.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Vulnerability in Siemens Mendix Runtime: CVE-2026-7891
Computer Software/Engineering3 months ago

Critical Vulnerability in Siemens Mendix Runtime: CVE-2026-7891

In July 2026, a critical vulnerability (CVE-2026-7891) was identified in Siemens Mendix Runtime, affecting all versions. The issue stems from inadequate documentation regarding the special behavior of the System.User entity, leading developers to potentially configure overly permissive access rules. This misconfiguration can result in unauthorized access to sensitive user data and privilege escalation within Mendix applications. Siemens has advised developers to review and update their access rules based on the revised documentation to mitigate this risk. This incident underscores the importance of comprehensive documentation and secure configuration practices in application development. As similar vulnerabilities continue to emerge, organizations must prioritize regular security assessments and adhere to best practices to prevent unauthorized data exposure and maintain compliance with regulatory standards.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Vulnerabilities in Panduit IntraVUE Threaten Industrial Control Systems
Utilities3 months ago

Critical Vulnerabilities in Panduit IntraVUE Threaten Industrial Control Systems

In July 2026, multiple critical vulnerabilities were identified in Panduit IntraVUE versions up to 3.2.1a14. These vulnerabilities include plaintext storage of passwords, unintended proxy usage, exposure of sensitive system information, and inadequate encryption strength. Exploitation could allow attackers to manipulate industrial control devices remotely without physical access or specialized knowledge, posing significant risks to critical infrastructure sectors such as manufacturing, energy, and water systems. The discovery of these vulnerabilities underscores the ongoing challenges in securing industrial control systems. As cyber threats targeting critical infrastructure continue to evolve, organizations must prioritize timely vulnerability management and adopt robust security measures to mitigate potential risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Vulnerabilities Discovered in Johnson Controls' C-CURE 9000 and Victor Application Servers
Critical Manufacturing3 months ago

Critical Vulnerabilities Discovered in Johnson Controls' C-CURE 9000 and Victor Application Servers

In July 2026, multiple critical vulnerabilities were identified in Johnson Controls' C-CURE 9000 and Victor application servers, widely used in physical security management. These vulnerabilities, including CVE-2026-21655, CVE-2026-21653, and CVE-2026-34496, could allow unauthenticated attackers to execute arbitrary code, perform server-side request forgery, and escalate privileges, potentially compromising physical security systems and sensitive data. ([johnsoncontrols.com](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories?utm_source=openai)) The discovery of these vulnerabilities underscores the increasing targeting of critical infrastructure by cyber threats. Organizations must prioritize patching and implementing robust security measures to protect against such exploits, as the exploitation of these flaws could lead to significant operational disruptions and security breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports