✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Industrial Automation
Breach intelligence, attack campaigns, and threat reports targeting the Industrial Automation sector.
Explore Other Sectors
Industrial Automation Threat Reports
Nation-State Cyberattacks on Water Systems: A Growing Threat
Between 2024 and 2026, nation-state actors from Iran, Russia, and China have increasingly targeted water and wastewater systems worldwide. These cyberattacks exploit vulnerabilities such as weak passwords, exposed programmable logic controllers (PLCs), and inadequate network segmentation, leading to unauthorized access and potential operational disruptions. Notably, in 2025, Russian-linked actors caused a municipal water tank overflow in Muleshoe, Texas, by accessing a remote industrial interface. Similarly, Iranian groups have been observed exploiting exposed PLCs in the U.S. and Israel, while China's Volt Typhoon group has compromised critical infrastructure, including water systems, aiming for strategic pre-positioning. ([darkreading.com](https://www.darkreading.com/ics-ot-security/iran-russia-china-target-water-systems-sabotage?utm_source=openai)) The current relevance of these incidents is underscored by the persistent and evolving nature of cyber threats to critical infrastructure. The exploitation of basic security oversights by sophisticated threat actors highlights the urgent need for enhanced cybersecurity measures in the water sector to prevent potential disruptions and safeguard public health and safety.
3 weeks ago
Kill Chain
Critical Vulnerability in Horner Automation Cscape: CVE-2026-12897
In June 2026, a critical vulnerability (CVE-2026-12897) was identified in Horner Automation's Cscape software versions prior to 10.2 SP3. This out-of-bounds read flaw in the CSP file parser could allow local attackers to disclose sensitive information and execute arbitrary code. The vulnerability was reported by Michael Heinzl and has a CVSS v3 score of 7.8, indicating high severity. Horner Automation has released Cscape 10.2 SP3 to address this issue. This incident underscores the importance of timely software updates in industrial control systems. As cyber threats targeting critical manufacturing sectors increase, organizations must prioritize patch management and implement robust security measures to protect against potential exploits.
4 weeks ago
Kill Chain
Critical Vulnerability in Delta Electronics DTM Soft: CVE-2026-12578
In June 2026, Delta Electronics' DTM Soft was found to have a critical vulnerability (CVE-2026-12578) involving the deserialization of untrusted data. This flaw allows attackers to execute arbitrary code by exploiting the software's handling of project files. The vulnerability affects all versions of DTM Soft, posing significant risks to systems utilizing this software. The discovery of this vulnerability underscores the ongoing challenges in securing industrial control systems, especially those integral to critical manufacturing sectors. Organizations are urged to apply the recommended mitigations promptly to prevent potential exploitation.
4 weeks ago
Kill Chain
Critical Vulnerabilities in Siemens SINEC INS: Immediate Action Required
In June 2026, Siemens disclosed multiple vulnerabilities in its SINEC INS software, versions prior to V1.0 SP2 Update 6. These vulnerabilities include improper input sanitization leading to OS command injection (CVE-2026-46746), path traversal (CVE-2026-46747), execution with unnecessary privileges (CVE-2026-46748), and the use of a one-way hash with a predictable salt (CVE-2026-46749). Exploitation of these flaws could allow attackers to execute arbitrary commands, access unintended file system locations, escalate privileges, and recover user passwords, potentially resulting in unauthorized access and control over affected systems. The disclosure underscores the critical importance of timely software updates and robust security practices in industrial control systems. Organizations utilizing SINEC INS are urged to upgrade to V1.0 SP2 Update 6 or later to mitigate these risks. This incident highlights the ongoing challenges in securing industrial networks against evolving cyber threats.
1 month ago
Kill Chain
ABB Freelance Security Lock Vulnerability CVE-2025-7064
In June 2026, a vulnerability identified as CVE-2025-7064 was disclosed in ABB's Freelance Security Lock software. This authentication bypass flaw allows attackers to access underlying Windows OS functions even when Freelance Operations is active, depending on system configuration and user permissions. Affected versions include Freelance through 2013, 2013 SP1, 2016, 2016 SP1, 2019, 2019 SP1, 2019 SP1 FP1, and 2024. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-7064?utm_source=openai)) The vulnerability has a CVSS score of 6.6, indicating a medium severity level. While no active exploitation has been reported, organizations using the affected versions should assess their exposure and apply patches as recommended by ABB. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-7064?utm_source=openai))
1 month ago
Kill Chain
Siemens Discloses Critical Vulnerability in WinCC Certificate Manager
In June 2026, Siemens disclosed a vulnerability (CVE-2026-24349) in the WinCC Certificate Manager component of SIMATIC WinCC Unified PC Runtime versions 16 through 21 (prior to V21 Update 2). The flaw involves insufficient protection of cryptographic key material, potentially allowing attackers with local access to extract sensitive information. Siemens has released an update for version 21 and recommends upgrading to V21 Update 2 or later. For earlier versions, no fixes are planned, and users are advised to implement specific countermeasures. This incident underscores the critical importance of securing cryptographic key material, especially in industrial control systems. Organizations should prioritize updating affected systems and apply recommended mitigations to prevent potential exploitation.
1 month ago
Kill Chain
Critical Vulnerability in Schneider Electric's EasyLogic T150 and Saitel DP Devices
In May 2026, Schneider Electric disclosed a critical vulnerability (CVE-2026-6865) in its EasyLogic T150 and Saitel DP Remote Terminal Units (RTUs) and Controllers. This path traversal flaw allows unauthorized access to sensitive files, potentially compromising system integrity. Affected versions include EasyLogic T150 firmware up to 11.06.31 and Saitel DP firmware up to 11.06.36. Schneider Electric has released firmware updates to address this issue. This incident underscores the persistent risks in industrial control systems, especially within critical infrastructure sectors like energy and manufacturing. Organizations must prioritize timely patching and robust access controls to mitigate such vulnerabilities.
1 month ago
Kill Chain
Critical Vulnerabilities in Rockwell Automation's FactoryTalk Historian SE Threaten Industrial Control Systems
In June 2026, Rockwell Automation disclosed multiple vulnerabilities in its FactoryTalk Historian Site Edition (SE) software, specifically affecting versions up to 11.00. The most critical, CVE-2025-13036, is an authentication bypass issue where an attacker can obtain a valid authentication token by repeatedly sending requests to the login endpoint. Additionally, CVE-2025-44019 and CVE-2025-36539 involve uncaught exceptions that could allow authenticated users to crash essential subsystems, leading to denial of service and potential data loss. These vulnerabilities pose significant risks to industrial control systems relying on this software. ([rockwellautomation.com](https://www.rockwellautomation.com/es-es/trust-center/security-advisories/advisory.SD1773.html?utm_source=openai)) The disclosure underscores the ongoing challenges in securing industrial control systems, highlighting the necessity for continuous monitoring and timely patching. Organizations must remain vigilant, as such vulnerabilities can be exploited to disrupt critical manufacturing operations, emphasizing the importance of robust cybersecurity practices in industrial environments.
1 month ago
Kill Chain
Critical Vulnerability in Mitsubishi Electric MELSEC iQ-F Series: CVE-2026-8805
In June 2026, Mitsubishi Electric disclosed a high-severity vulnerability (CVE-2026-8805) in its MELSEC iQ-F Series FX5-EIP EtherNet/IP Module. This flaw allows remote attackers to cause a denial-of-service (DoS) condition by rapidly establishing numerous TCP connections, leading to improper memory access and system instability. Affected versions include FX5-EIP up to and including version 1.000. ([mitsubishielectric.com](https://www.mitsubishielectric.com/fa/about-us/security/vulnerability/?utm_source=openai)) This incident underscores the critical importance of securing industrial control systems against network-based attacks. As cyber threats targeting operational technology (OT) environments increase, organizations must prioritize timely vulnerability management and implement robust network defenses to safeguard critical manufacturing processes.
1 month ago
Kill Chain
Critical DoS Vulnerability in Mitsubishi Electric's MELSEC iQ-F Series FX5-ENET/IP Module (CVE-2026-1876)
In March 2026, Mitsubishi Electric disclosed a high-severity denial-of-service (DoS) vulnerability (CVE-2026-1876) in its MELSEC iQ-F Series FX5-ENET/IP Ethernet Module. This flaw allows remote attackers to render the device unresponsive by continuously sending UDP packets, necessitating a system reset for recovery. The vulnerability affects all versions of the FX5-ENET/IP module, posing significant risks to industrial control systems reliant on this equipment. The incident underscores the critical importance of securing industrial control systems against network-based attacks. As similar vulnerabilities continue to emerge, organizations must proactively implement robust network security measures, including firewalls and VPNs, to mitigate potential threats and ensure operational continuity.
1 month ago
Kill Chain
Critical Vulnerability in AzeoTech DAQFactory: CVE-2026-12390
In June 2026, a critical vulnerability (CVE-2026-12390) was identified in AzeoTech's DAQFactory software, versions 21.1 and prior. This Type Confusion flaw allows attackers to execute arbitrary code by tricking users into opening malicious .ctl files. The vulnerability poses significant risks to systems utilizing DAQFactory, potentially leading to unauthorized access and control. The disclosure underscores the ongoing challenges in securing industrial control systems, especially as attackers increasingly target such environments. Organizations are urged to apply recommended mitigations promptly to prevent exploitation and maintain operational integrity.
1 month ago
Kill Chain
Critical Vulnerabilities in Rockwell Automation's CompactLogix 5370 Controllers: Immediate Action Required
In June 2026, Rockwell Automation disclosed two critical vulnerabilities affecting its CompactLogix 5370 series controllers, specifically models L1, L2, and L3. The first vulnerability, CVE-2025-11694, involves improper validation of sequence numbers and source IP addresses in the CIP protocol, allowing attackers to exploit exposed Connection IDs to induce denial-of-service conditions. The second, CVE-2026-9307, pertains to the exposure of sensitive system information through the controller's web server, which reveals CIP Connection IDs to unauthenticated users, potentially leading to similar denial-of-service attacks. Both vulnerabilities have been addressed in firmware version V38.011, and users are strongly advised to update their systems accordingly. ([rockwellautomation.com](https://www.rockwellautomation.com/es-es/trust-center/security-advisories/advisory.PN1025.html?utm_source=openai)) These vulnerabilities underscore the persistent risks in industrial control systems, particularly in critical manufacturing sectors. The disclosure highlights the necessity for continuous monitoring, timely patch management, and adherence to cybersecurity best practices to safeguard operational technology environments from potential disruptions.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports