✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Industrial Automation
Breach intelligence, attack campaigns, and threat reports targeting the Industrial Automation sector.
Explore Other Sectors
Industrial Automation Threat Reports
Critical Vulnerabilities in Rockwell Automation FLEX I/O EtherNet/IP Adapters: CVE-2026-0646 and CVE-2026-0647
In June 2026, Rockwell Automation disclosed two critical vulnerabilities affecting their FLEX I/O EtherNet/IP Adapters, specifically models 1794-AENTR and 1794-AENTRXT version 2.012. The first vulnerability (CVE-2026-0646) involves improper memory handling of CIP protocol requests, leading to a denial-of-service condition that requires a manual reset. The second vulnerability (CVE-2026-0647) allows unauthenticated attackers to change the device's web interface password via a crafted HTTP GET request, potentially resulting in unauthorized access and account takeover. ([netstorage.rockwellautomation.com](https://netstorage.rockwellautomation.com/WebFiles/Resources/RAFirmware/1794-Products/1794-RN076G-EN-E.pdf?rwtoken=1778347671_97396ee2108d37e1ebe005d3b4e136a3&utm_source=openai)) These vulnerabilities are particularly concerning for critical manufacturing sectors, as exploitation could disrupt industrial operations and compromise system integrity. The increasing connectivity of industrial control systems heightens the risk of such vulnerabilities being exploited, emphasizing the need for timely updates and robust security measures.
1 month ago
Kill Chain
Critical Vulnerability in Rockwell Automation's FactoryTalk Analytics PavilionX: CVE-2025-14272
In June 2026, Rockwell Automation disclosed a critical vulnerability (CVE-2025-14272) in its FactoryTalk Analytics PavilionX software, versions prior to 7.01. This flaw arises from improper authorization enforcement in API endpoints, potentially allowing unauthorized actors to execute privileged operations, including user and role management. The vulnerability affects critical manufacturing sectors worldwide, with Rockwell Automation headquartered in the United States. To mitigate this risk, users are advised to update to version 7.01 or later. This incident underscores the persistent challenges in securing industrial control systems (ICS) and the importance of timely software updates. As cyber threats targeting ICS environments continue to evolve, organizations must remain vigilant and proactive in addressing vulnerabilities to safeguard operational integrity.
1 month ago
Kill Chain
Critical Vulnerability in Schneider Electric's EcoStruxure Panel Server Devices (CVE-2026-6866)
In May 2026, Schneider Electric disclosed a vulnerability (CVE-2026-6866) in its EcoStruxure Panel Server devices, including models PAS400, PAS600, PAS600V2, PAS800, and PAS800V2, running firmware versions 002.005.000 and prior. This flaw, identified as CWE-1188, allows device credentials to revert to factory defaults under rare conditions, potentially enabling unauthorized access to operational technology (OT) networks. The vulnerability poses a significant risk to critical infrastructure sectors such as energy, utilities, and manufacturing, as it could lead to unauthorized disclosure of sensitive information. Schneider Electric has released firmware version 002.006.000 to address this issue. Organizations are urged to apply this update promptly to mitigate potential security breaches. ([techjacksolutions.com](https://techjacksolutions.com/scc-intel/schneider-electric-ecostruxure-panel-server-credential-reset-flaw-exposes-ot-gateways-in-critical-infrastructure/?utm_source=openai)) The incident underscores the importance of maintaining up-to-date firmware and implementing robust access controls in OT environments. As cyber threats targeting industrial control systems continue to evolve, ensuring the security of gateway devices like the EcoStruxure Panel Server is crucial to prevent unauthorized access and protect critical infrastructure.
1 month ago
Kill Chain
Critical Vulnerabilities in Hitachi Energy's ITT600 Explorer: CVE-2024-8176 and CVE-2025-59375
In May 2026, Hitachi Energy disclosed two critical vulnerabilities in its ITT600 Explorer product, identified as CVE-2024-8176 and CVE-2025-59375. These vulnerabilities stem from issues within the libexpat library used by the product's IEC61850 functionality. CVE-2024-8176 involves a stack overflow due to improper restriction of XML entity expansion depth, potentially leading to denial of service (DoS) or memory corruption. CVE-2025-59375 allows attackers to trigger large dynamic memory allocations via small, crafted XML documents, also resulting in DoS conditions. Both vulnerabilities affect ITT600 Explorer versions prior to 2.1 SP6. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/cve-2024-8176?utm_source=openai)) The disclosure underscores the critical importance of securing components within industrial control systems, especially those handling XML parsing. Given the widespread use of libexpat across various applications, these vulnerabilities highlight the necessity for organizations to promptly update affected systems to mitigate potential exploitation risks.
1 month ago
Kill Chain
Critical Security Flaw in Jinan USR IOT's USR-W610 Converter Exposes Networks to Attack
In May 2026, a critical vulnerability (CVE-2026-7786) was identified in Jinan USR IOT Technology Limited's USR-W610 RS232/485 to Wi-Fi/Ethernet Converter, firmware version 7.03T.07. The device contains hard-coded plaintext administrative credentials embedded within the firmware, which can be extracted and used by attackers to gain full administrator access. This flaw poses significant risks, including unauthorized control over the device and potential network intrusion. The vendor has not responded to coordination attempts, leaving users without an official patch or remediation guidance. This incident underscores the persistent issue of hard-coded credentials in IoT devices, a vulnerability that has been exploited in various sectors, leading to unauthorized access and control. The lack of vendor response highlights the challenges in securing IoT devices, emphasizing the need for proactive security measures and regular vulnerability assessments to mitigate such risks.
1 month ago
Kill Chain
Schneider Electric's EcoStruxure Machine Expert HVAC Vulnerability: CVE-2026-6332
In May 2026, Schneider Electric disclosed a vulnerability (CVE-2026-6332) in its EcoStruxure Machine Expert HVAC software versions prior to 1.10.0. This flaw involves the cleartext storage of sensitive information, potentially exposing protected source code when accessed by authorized users for editing or compiling. Such exposure could lead to a loss of confidentiality and unauthorized disclosure of proprietary logic and operational details. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-6332?utm_source=openai)) This incident underscores the critical importance of securing engineering workstations and programming environments in industrial settings. As industrial control systems become increasingly interconnected, ensuring the confidentiality and integrity of source code is paramount to prevent potential reconnaissance and exploitation by malicious actors.
1 month ago
Kill Chain
Enhancing Industrial Security: AI-Assisted Sparkplug B Protocol Fuzzer Released
In May 2026, Bishop Fox released a security fuzzer for the Sparkplug B protocol, a dominant MQTT-based protocol in industrial control and SCADA environments. This tool systematically tests all nine message types, 19 data types, and over 87 unique field paths defined by the Eclipse Sparkplug specification. The fuzzer was developed with AI assistance, specifically utilizing Claude Code to identify coverage gaps and Python defects, resulting in a hardened, self-contained tool with CLI, logging, and passive network discovery capabilities. This development is crucial for ICS and SCADA operators, device vendors, and defenders, as it enables the identification of crashes, protocol violations, and state-handling bugs in Sparkplug B endpoints before attackers can exploit them. The tool is available on GitHub for immediate use.
1 month ago
Kill Chain
Critical DoS Vulnerability in ABB B&R Automation Runtime (CVE-2025-3450)
In October 2025, ABB identified a critical vulnerability (CVE-2025-3450) in the System Diagnostics Manager (SDM) component of B&R Automation Runtime versions prior to 6.3 and Q4.93. This flaw allows unauthenticated, network-based attackers to delete data, leading to denial-of-service conditions. The vulnerability stems from improper resource locking within the SDM, potentially causing affected systems to cease operation upon exploitation. ABB has released updates to address this issue and recommends users upgrade to Automation Runtime versions 6.3 or Q4.93 to mitigate the risk. This incident underscores the importance of timely patch management and robust network security practices, especially in critical infrastructure sectors where such vulnerabilities can have significant operational impacts.
2 months ago
Kill Chain
Critical Vulnerability in ABB AC500 V2 PLCs: CVE-2025-7745
In July 2025, a buffer over-read vulnerability, identified as CVE-2025-7745, was discovered in ABB's AC500 V2 programmable logic controllers (PLCs), affecting versions up to and including 2.5.2. This flaw could allow unauthorized access to fragments of previously transmitted Modbus telegrams, potentially exposing sensitive information. The vulnerability was reported by Reid Wightman of Dragos, Inc., and ABB released firmware version 2.5.3 to address the issue. The incident underscores the critical importance of timely patch management in industrial control systems (ICS). As cyber threats targeting ICS environments continue to evolve, organizations must remain vigilant in updating and securing their operational technology to prevent potential exploitation of such vulnerabilities.
2 months ago
Kill Chain
Critical Vulnerabilities in ABB B&R Automation Runtime Threaten Industrial Systems
In October 2025, ABB B&R Automation Runtime versions prior to 6.4 were found to have multiple vulnerabilities, including CVE-2025-3449, CVE-2025-3448, and CVE-2025-11498. These flaws could allow unauthenticated attackers to hijack sessions, execute arbitrary JavaScript in users' browsers, and inject malicious formulas into CSV files. Exploitation required network access and user interaction, posing significant risks to industrial control systems. The discovery of these vulnerabilities underscores the critical need for robust security measures in industrial automation environments. As cyber threats targeting operational technology increase, organizations must prioritize timely updates and comprehensive security practices to safeguard against potential exploits.
2 months ago
Kill Chain
Critical Vulnerability in Universal Robots' PolyScope 5: CVE-2026-8153
In May 2026, a critical command injection vulnerability (CVE-2026-8153) was discovered in the Dashboard Server interface of Universal Robots' PolyScope 5 software. This flaw allowed unauthenticated attackers with network access to execute arbitrary commands on the robot's operating system, potentially leading to full system compromise. Universal Robots promptly addressed the issue by releasing version 5.25.1, which patches the vulnerability. Organizations utilizing affected versions are strongly advised to update immediately to mitigate potential risks. This incident underscores the growing cybersecurity challenges in operational technology (OT) environments, particularly as industrial systems become more interconnected. The exploitation of such vulnerabilities can lead to significant operational disruptions and safety hazards, highlighting the need for robust security measures and timely software updates in critical infrastructure.
2 months ago
Kill Chain
Critical Vulnerability in ABB CoreSense Products: CVE-2025-3465
In October 2025, ABB disclosed a path traversal vulnerability (CVE-2025-3465) in its CoreSense™ HM and CoreSense™ M10 products, affecting versions up to 2.3.1 and 1.4.1.12, respectively. This flaw allows unauthenticated users to access restricted directories, potentially leading to complete system compromise and exposure of sensitive information. ABB has released updates to address this issue and recommends that customers apply them promptly. This incident underscores the critical importance of timely vulnerability management in industrial control systems. As cyber threats targeting critical infrastructure continue to evolve, organizations must remain vigilant and proactive in applying security patches to mitigate potential risks.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports