✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Industrial Automation
Breach intelligence, attack campaigns, and threat reports targeting the Industrial Automation sector.
Explore Other Sectors
Industrial Automation Threat Reports
Critical Vulnerability in ABB Ability Edgenius: Immediate Action Required
In November 2025, a critical authentication bypass vulnerability (CVE-2025-10571) was identified in ABB Ability Edgenius versions 3.2.0.0 and 3.2.1.1. This flaw allows unauthenticated attackers on adjacent networks to send specially crafted messages to the system node, enabling them to install and run arbitrary code, uninstall applications, and modify configurations of installed applications. The vulnerability has a CVSS v3.1 base score of 9.6, indicating its critical severity. ABB has released version 3.2.2.0 to address this issue and recommends immediate upgrading. ([library.e.abb.com](https://library.e.abb.com/public/6fed91aad9034910b99298c58e407979/7PAA022088_B_en_Edgenius%20Management%20Portal%20Authentication%20Bypass.pdf?x-sign=4U%2FLxIrP3%2FTAiNhR45U6GCkLpQhWbUhpnelc58Oz1NsjOPYafSbXv48t5cNUuiBc&utm_source=openai)) The discovery of this vulnerability underscores the increasing risks associated with edge computing platforms in industrial environments. As these systems often bridge IT and operational technology (OT) networks, their compromise can lead to significant operational disruptions and safety hazards. Organizations must prioritize securing such platforms to prevent unauthorized access and potential exploitation.
2 months ago
Kill Chain
Critical Security Vulnerabilities Discovered in ABB AWIN Gateways
In March 2026, ABB disclosed multiple vulnerabilities in its AWIN Gateways, specifically affecting firmware versions 2.0-0 and 2.0-1 on the GW100 rev.2, and versions 1.2-0 and 1.2-1 on the GW120. These vulnerabilities include authentication bypass by capture-replay (CVE-2025-13777), missing authentication for critical functions leading to remote device reboot (CVE-2025-13778), and unauthorized access to system configurations revealing sensitive details (CVE-2025-13779). Exploitation of these flaws could allow attackers to gain unauthorized access, disrupt device operations, and expose confidential information. ([library.e.abb.com](https://library.e.abb.com/public/3df44661342a482f9b39595fb1457446/4JNO000329_A_en%20Vulnerabilities%20in%20Embedded%20Webserver.pdf?x-sign=hpo%2FlHiVW9S%2FJFfI7on%2BhNiDyo6eVzQkPp6%2BJB4nbIGqiVRH4VpRTPwCRDjUFbLP&utm_source=openai)) The disclosure underscores the critical need for robust security measures in industrial control systems, as such vulnerabilities can have significant operational and safety implications. Organizations utilizing ABB AWIN Gateways should promptly apply the recommended firmware updates and review their network security protocols to mitigate potential risks.
2 months ago
Kill Chain
Critical Vulnerabilities in ABB Ability Symphony Plus Engineering: Immediate Action Required
In April 2026, ABB disclosed multiple vulnerabilities in its Ability Symphony Plus Engineering software, primarily due to outdated PostgreSQL components. These vulnerabilities, including CVE-2023-5869, CVE-2023-39417, CVE-2024-7348, and CVE-2024-0985, could allow attackers with network access to execute arbitrary code, potentially compromising entire systems. Affected versions range from 2.2 to 2.4 SP2. ABB has released updates to address these issues and recommends immediate application to mitigate risks. This incident underscores the critical importance of timely software updates and robust network security practices in industrial control systems. Organizations must remain vigilant against emerging threats targeting outdated components to ensure operational integrity and security.
2 months ago
Kill Chain
Unveiling 'fast16': The Pre-Stuxnet Malware Targeting Engineering Software
In April 2026, SentinelOne researchers uncovered 'fast16,' a previously undocumented Lua-based malware framework dating back to 2005. This sophisticated tool targeted high-precision engineering and physics simulation software, subtly altering calculations to introduce systematic errors. Unlike typical malware of its era, fast16 was engineered for strategic sabotage, potentially undermining scientific research and engineering projects without immediate detection. The discovery of fast16 highlights the advanced capabilities of state-sponsored cyber operations predating known incidents like Stuxnet. It underscores the long-standing use of cyber tools for covert sabotage, emphasizing the need for vigilance in protecting critical infrastructure and sensitive research from such sophisticated threats.
3 months ago
Kill Chain
Critical Authentication Bypass Vulnerability in Siemens SINEC NMS (CVE-2026-24032)
In April 2026, Siemens disclosed a critical authentication bypass vulnerability (CVE-2026-24032) in its SINEC NMS software, specifically within the User Management Component (UMC). This flaw allows unauthenticated remote attackers to bypass authentication mechanisms, potentially granting unauthorized access to network management functionalities. The vulnerability affects all versions of SINEC NMS prior to V4.0 SP3. Siemens has released an updated version to address this issue and strongly recommends users to upgrade promptly. This incident underscores the persistent risks associated with authentication weaknesses in critical infrastructure management systems. Organizations are urged to assess their network management tools for similar vulnerabilities and to implement robust access controls to mitigate potential exploitation.
3 months ago
Kill Chain
Siemens CVE-2025-40745: Addressing Certificate Validation Vulnerabilities in Industrial Software
In April 2026, Siemens disclosed a vulnerability (CVE-2025-40745) in multiple applications, including Siemens Software Center, Simcenter 3D, Simcenter Femap, Simcenter STAR-CCM+, Solid Edge SE2025, Solid Edge SE2026, and Tecnomatix Plant Simulation. The flaw involves improper validation of client certificates when connecting to the Analytics Service endpoint, potentially allowing unauthenticated remote attackers to perform man-in-the-middle attacks. Siemens has released updates to address this issue and recommends users upgrade to the latest versions. This incident underscores the critical importance of proper certificate validation in industrial software to prevent unauthorized data interception and manipulation. Organizations using affected Siemens products should promptly apply the recommended updates to mitigate potential security risks.
3 months ago
Kill Chain
Siemens TPM 2.0 Vulnerability (CVE-2025-2884) Disclosure
In April 2026, Siemens disclosed a vulnerability (CVE-2025-2884) in its TPM 2.0 implementation, affecting multiple products including SIMATIC and SIPLUS IPC series. The flaw, an out-of-bounds read in the CryptHmacSign function, could allow local attackers to access sensitive information or cause a denial of service. Siemens has released updates for several affected products and is preparing further fixes, recommending users to update to the latest versions. ([cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-628843.html?utm_source=openai)) This incident underscores the critical importance of timely firmware updates and robust access controls, especially as TPM vulnerabilities can compromise foundational security features like encryption and secure boot processes.
3 months ago
Kill Chain
Critical Vulnerability in Siemens RUGGEDCOM SAM-P: Immediate Action Required
In April 2026, a critical privilege escalation vulnerability (CVE-2026-27668) was identified in Siemens RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) versions prior to V5.8. This flaw allows authenticated User Administrators to modify their own group memberships, potentially granting themselves elevated access across device groups. Siemens has addressed this issue by releasing version V5.8 and recommends immediate updates to mitigate the risk. ([cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-741509.html?utm_source=openai)) This incident underscores the importance of stringent access controls and regular software updates in industrial control systems. Organizations should review their administrative privileges and ensure that all systems are updated to prevent unauthorized access and maintain operational integrity.
3 months ago
Kill Chain
Critical Vulnerabilities Discovered in Serial-to-IP Converters: A Wake-Up Call for OT Security
In April 2026, Forescout Technologies identified 22 new vulnerabilities in serial-to-IP converters from Lantronix and Silex, devices integral to connecting legacy industrial equipment to modern networks. These vulnerabilities, including remote code execution and authentication bypass, could allow attackers to disrupt operations, move laterally across networks, and tamper with sensitive data. Notably, tens of thousands of these devices are exposed online, increasing the risk to critical infrastructure sectors such as utilities, manufacturing, and healthcare. This discovery underscores the persistent security challenges in operational technology environments, particularly concerning devices that bridge legacy systems with modern networks. The prevalence of outdated components and inadequate security measures in these converters highlights the urgent need for organizations to assess and fortify their OT security postures to prevent potential exploitation.
3 months ago
Kill Chain
BRIDGE:BREAK Vulnerabilities Threaten Critical Infrastructure Security
In April 2026, Forescout Technologies identified 22 vulnerabilities in serial-to-IP converters from Lantronix and Silex, devices integral to connecting legacy industrial equipment to modern networks. These vulnerabilities, collectively named BRIDGE:BREAK, could allow attackers to disrupt operations, move laterally across networks, tamper with sensitive data, or take control of affected devices. The flaws include remote code execution, authentication bypass, firmware manipulation, denial of service, and exposure of confidential information. Notably, tens of thousands of these devices are accessible over the internet, significantly broadening the attack surface for potential cyberattacks. This discovery underscores the persistent security challenges in operational technology environments, especially concerning devices that bridge legacy systems with modern infrastructure. The prevalence of these vulnerabilities highlights the need for organizations to reassess their security postures, particularly in sectors like utilities, manufacturing, and healthcare, where such devices are commonly deployed.
3 months ago
Kill Chain
ZionSiphon Malware: A New Threat to Israeli Water Infrastructure
In April 2026, cybersecurity researchers identified a new malware strain named ZionSiphon, specifically engineered to target Israeli water treatment and desalination systems. The malware exhibits capabilities such as establishing persistence, modifying local configuration files, and scanning for operational technology (OT) services within local networks. Notably, ZionSiphon is designed to operate exclusively within Israeli IP address ranges and targets processes associated with water treatment operations, including chlorine dosing and pressure control systems. While the current version contains a flaw that prevents full execution, its architecture indicates a significant advancement in OT-targeted cyber threats. ([thehackernews.com](https://thehackernews.com/2026/04/researchers-detect-zionsiphon-malware.html?utm_source=openai)) This discovery underscores a growing trend of politically motivated cyberattacks aimed at critical infrastructure. The emergence of ZionSiphon highlights the increasing sophistication of threats targeting OT environments, emphasizing the need for enhanced security measures to protect essential services from potential sabotage.
3 months ago
Kill Chain
Dragon Boss Solutions' 2025 Adware Supply Chain Attack: A Wake-Up Call for Cybersecurity
In March 2025, Dragon Boss Solutions LLC, a company based in the United Arab Emirates, distributed adware that exploited an unsecured software update mechanism to disable antivirus programs on over 25,000 systems globally. The adware utilized Advanced Installer's update tool to deploy malicious payloads with SYSTEM privileges, effectively neutralizing security defenses and establishing persistence through scheduled tasks and Windows Management Instrumentation (WMI) event subscriptions. This left numerous high-value networks, including educational institutions, government entities, and critical infrastructure, vulnerable to further exploitation. ([huntress.com](https://www.huntress.com/blog/pups-grow-fangs?utm_source=openai)) This incident underscores the evolving threat landscape where seemingly benign software can transform into significant security risks. The exploitation of legitimate update mechanisms highlights the necessity for organizations to scrutinize software supply chains and implement robust monitoring to detect and mitigate such sophisticated attacks. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/harmless-global-adware-av-killer/?utm_source=openai))
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports