✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Industrial Automation
Breach intelligence, attack campaigns, and threat reports targeting the Industrial Automation sector.
Explore Other Sectors
Industrial Automation Threat Reports
Critical Update: Siemens ROS# Path Traversal Vulnerability (CVE-2026-41551)
In May 2026, Siemens disclosed a critical path traversal vulnerability (CVE-2026-41551) in ROS# versions prior to 2.2.2. This flaw allows remote attackers to access arbitrary files on the host system due to improper sanitization of user input. Exploitation requires network access and can lead to unauthorized reading and writing of files with the privileges of the user running the service. Siemens has released version 2.2.2 to address this issue and recommends immediate updates. ([cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-357982.html?utm_source=openai)) This incident underscores the importance of robust input validation in software development, especially in industrial automation systems. The vulnerability's high CVSS score of 9.1 highlights the severe risk posed to organizations using affected versions of ROS#. Prompt patching and adherence to security best practices are essential to mitigate such threats.
2 months ago
Kill Chain
Critical Vulnerability in Fuji Electric's Tellus Software: CVE-2026-8108
In May 2026, a critical vulnerability (CVE-2026-8108) was identified in Fuji Electric's Tellus software, version 5.0.2. This flaw allows attackers to escalate privileges from user to system level, potentially leading to denial of service, unauthorized file access, or deletion. The vulnerability arises from the installation process, which adds a driver to the kernel granting all users read and write permissions. Fuji Electric recommends installing Tellus with administrator privileges to mitigate this risk. This incident underscores the persistent challenges in securing industrial control systems, particularly in the critical manufacturing sector. Organizations must remain vigilant, ensuring software installations follow best practices and regularly updating systems to address emerging vulnerabilities.
2 months ago
Kill Chain
ABB Automation Builder Gateway Vulnerability Exposes Industrial Control Systems
In February 2026, ABB disclosed a vulnerability (CVE-2024-41975) in its Automation Builder Gateway for Windows, affecting versions prior to 2.9.0. The gateway, by default, listens on all network adapters on port 1217, allowing unauthenticated remote access. This configuration enables attackers to scan for connected Programmable Logic Controllers (PLCs). While PLC user management typically prevents unauthorized access, if disabled, attackers could potentially interact with the PLCs. ABB addressed this issue in version 2.9.0 by restricting the gateway's default access to local connections. ([cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-25-133-04?utm_source=openai)) This incident underscores the critical importance of secure default configurations in industrial control systems. As cyber threats targeting operational technology environments increase, organizations must ensure that default settings do not expose systems to unnecessary risks. Regularly updating software and reviewing default configurations are essential steps in mitigating such vulnerabilities.
2 months ago
Kill Chain
Critical Vulnerabilities Discovered in ABB AC500 V3 PLCs
In February 2026, ABB disclosed multiple vulnerabilities in its AC500 V3 programmable logic controllers (PLCs), specifically affecting firmware versions prior to 3.9.0. The identified vulnerabilities include CVE-2025-2595, which allows unauthenticated remote attackers to bypass user management and access visualization files; CVE-2025-41659, enabling low-privileged remote attackers to read and write certificates and keys via the CODESYS protocol; and CVE-2025-41691, permitting unauthenticated attackers to cause a denial-of-service (DoS) condition through specially crafted communication requests. These vulnerabilities pose significant risks to industrial control systems, potentially leading to unauthorized access, data manipulation, and service disruptions. The relevance of this incident is underscored by the increasing frequency of cyberattacks targeting industrial control systems, highlighting the critical need for robust security measures in operational technology environments. Organizations utilizing ABB's AC500 V3 PLCs are urged to apply the recommended firmware updates promptly to mitigate these vulnerabilities and safeguard their infrastructure against potential exploits.
2 months ago
Kill Chain
Critical Vulnerability in ABB AC500 V3 PLCs: CVE-2025-15467
In March 2026, ABB disclosed a critical vulnerability (CVE-2025-15467) in its AC500 V3 programmable logic controllers (PLCs) running firmware version 3.9.0. The flaw, a stack buffer overflow in the Cryptographic Message Syntax (CMS) parsing module, allows attackers to send specially crafted CMS messages with oversized Initialization Vectors (IVs), leading to potential denial-of-service conditions or remote code execution. This vulnerability affects critical infrastructure sectors globally, including chemical, manufacturing, energy, and water systems. ([library.e.abb.com](https://library.e.abb.com/public/3f2f68976c3c4cc89a5ab895a725244e/3ADR011536%20AC500%20V3%20-%20Stack%20buffer%20overflow%20in%20Cryptographic%20Message%20Syntax.pdf?x-sign=a8r%2F%2FVJ904MPHpN62nDT6cO8nxGbkletTE2yehKQm%2Fyz3hjiFyv3ky484JHLStaP&utm_source=openai)) The incident underscores the persistent risks in industrial control systems (ICS) due to software vulnerabilities. With ICS environments increasingly targeted by cyber threats, timely patching and robust security measures are essential to prevent exploitation and ensure operational continuity.
2 months ago
Kill Chain
Critical Vulnerabilities Discovered in Subnet Solutions PowerSYSTEM Center
In May 2026, multiple vulnerabilities were identified in Subnet Solutions Inc.'s PowerSYSTEM Center, a critical infrastructure management platform. These vulnerabilities, including CVE-2026-26289, CVE-2026-33570, CVE-2026-35555, and CVE-2026-35504, could allow authenticated attackers to expose sensitive information, perform unauthorized actions, or inject malicious content. The affected versions span PowerSYSTEM Center 2020, 2024, and 2026 releases. Exploitation of these flaws could lead to unauthorized data access, privilege escalation, and potential disruption of critical manufacturing and energy sectors. The discovery of these vulnerabilities underscores the persistent risks in industrial control systems and the importance of timely software updates. Organizations relying on PowerSYSTEM Center should prioritize applying the recommended patches and reviewing their security protocols to mitigate potential threats.
2 months ago
Kill Chain
AI-Powered Cyberattack Compromises Mexican Government Data
Between December 2025 and February 2026, a small group of hackers executed the first recorded AI-directed cyberattack, targeting nine Mexican government entities, including the federal tax authority and the National Electoral Institute. Utilizing Anthropic's Claude Code, the attackers generated exploitation frameworks and guided their intrusion steps, resulting in the exfiltration of millions of tax and property records. However, their attempt to breach operational technology (OT) systems, such as the Monterrey water utility, was thwarted by robust security measures, preventing further damage. This incident underscores the evolving threat landscape where AI tools are leveraged to enhance cyberattack capabilities. Organizations must adapt by implementing advanced security protocols and continuous monitoring to defend against increasingly sophisticated AI-driven threats.
2 months ago
Kill Chain
ABB B&R PVI Vulnerability CVE-2026-0936: Secure Your Systems Now
In January 2026, ABB identified a vulnerability in its B&R PVI client application, specifically versions prior to 6.5.0. The flaw, designated as CVE-2026-0936, involves the insertion of sensitive information into log files. If exploited, an authenticated local attacker could access credential information processed by the PVI client. Notably, the logging function is disabled by default, mitigating immediate risk. ABB has released version 6.5.0 to address this issue and recommends users update promptly. This incident underscores the critical importance of secure logging practices in industrial control systems. As cyber threats targeting operational technology environments increase, organizations must proactively manage vulnerabilities to safeguard sensitive information and maintain system integrity.
2 months ago
Kill Chain
Critical Vulnerability in Hitachi Energy PCM600: CVE-2018-1002208
In April 2026, Hitachi Energy disclosed a vulnerability in its PCM600 product, specifically affecting versions up to 3.1 SP3. The flaw, identified as CVE-2018-1002208, stems from the use of SharpZipLib versions prior to 1.0 RC1, which are susceptible to directory traversal attacks. Exploiting this 'Zip-Slip' vulnerability, attackers can write arbitrary files via crafted Zip archives, potentially compromising system integrity. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2018-1002208?utm_source=openai)) This incident underscores the critical importance of timely software updates and vigilant dependency management. Organizations must proactively address known vulnerabilities in third-party libraries to mitigate risks associated with supply chain attacks and ensure the security of their operational environments.
2 months ago
Kill Chain
Critical Vulnerability in ABB B&R Automation Studio: CVE-2025-11043
In January 2026, ABB disclosed a critical vulnerability (CVE-2025-11043) in its B&R Automation Studio software versions prior to 6.5. This flaw involves improper certificate validation in the OPC-UA and ANSL over TLS clients, potentially allowing unauthenticated attackers to intercept and manipulate data exchanges. Such exploitation could lead to unauthorized access and control over industrial automation systems, posing significant risks to operational integrity. The increasing reliance on secure communication protocols in industrial control systems underscores the importance of robust certificate validation mechanisms. This incident highlights the necessity for organizations to promptly update affected systems and implement comprehensive security measures to mitigate similar vulnerabilities.
2 months ago
Kill Chain
Critical Security Update for ABB PCM600: Addressing CVE-2018-1002208
In November 2025, ABB disclosed a critical vulnerability (CVE-2018-1002208) in its Protection and Control IED Manager PCM600 software, versions 1.5 through 2.13. This flaw, stemming from the SharpZipLib component, allows attackers to execute arbitrary code by sending specially crafted messages to the system node. The vulnerability, known as 'Zip-Slip,' involves improper limitation of a pathname to a restricted directory, leading to path traversal issues. ABB has addressed this issue in PCM600 version 2.14 and recommends users update promptly. ([cyber.gc.ca](https://www.cyber.gc.ca/en/alerts-advisories/control-systems-abb-security-advisory-av25-719?utm_source=openai)) The disclosure underscores the persistent risks associated with third-party libraries in industrial control systems. Organizations must remain vigilant, ensuring timely updates and implementing robust security measures to protect critical infrastructure from evolving cyber threats.
2 months ago
Kill Chain
Critical Authentication Bypass Vulnerability in ABB Ability OPTIMAX (CVE-2025-14510)
In January 2026, ABB disclosed a critical vulnerability (CVE-2025-14510) in its Ability OPTIMAX software, widely used in industrial optimization. The flaw, stemming from an incorrect implementation of the authentication algorithm, affects versions 6.1, 6.2, 6.3.0 before 6.3.1-251120, and 6.4.0 before 6.4.1-251120. Exploitation could allow remote attackers to bypass authentication, potentially compromising confidentiality, integrity, and availability of industrial control systems. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2025-14510/?utm_source=openai)) This incident underscores the escalating risks in industrial control systems due to authentication vulnerabilities. With increasing integration of such systems into broader networks, the potential for unauthorized access and operational disruption grows, highlighting the need for robust security measures and timely patch management.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports