The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Industrial Automation
Breach intelligence, attack campaigns, and threat reports targeting the Industrial Automation sector.
Explore Other Sectors
Industrial Automation Threat Reports
Critical Vulnerability in Portwell Engineering Toolkits Poses Risks to Industrial Control Systems
In March 2026, a critical vulnerability (CVE-2026-3437) was identified in Portwell Engineering Toolkits version 4.8.2, widely used in industrial control systems. This flaw allows local authenticated attackers to read and write arbitrary kernel memory via the toolkit's driver, potentially leading to privilege escalation or denial-of-service conditions. The vulnerability has a CVSS v3.1 base score of 8.8, indicating high severity. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-3437?utm_source=openai)) The vulnerability underscores the importance of securing engineering workstations in industrial environments, as exploitation could compromise critical manufacturing and energy sectors. Organizations are advised to implement defense-in-depth strategies, restrict access to engineering systems, and monitor for unauthorized activities to mitigate potential risks. ([therealistjuggernaut.com](https://therealistjuggernaut.com/2026/03/03/portwell-engineering-toolkits-vulnerability-raises-privilege-escalation-risks-in-industrial-development-environments/?utm_source=openai))
6 months ago
Kill Chain
Critical Vulnerabilities in Hitachi Energy RTU500 Series Require Immediate Attention
In February 2026, Hitachi Energy disclosed multiple vulnerabilities affecting its RTU500 series products, including CVE-2026-1772, CVE-2026-1773, CVE-2024-8176, and CVE-2025-59375. These vulnerabilities, if exploited, could lead to unauthorized access to user management information and potential device outages. The affected firmware versions range from 12.7.1 to 13.8.1. Hitachi Energy has released firmware updates to address these issues and recommends users implement the provided mitigations to secure their systems. This incident underscores the critical importance of timely vulnerability management in industrial control systems, especially within the energy sector. Organizations are urged to stay vigilant and apply security patches promptly to mitigate potential risks associated with such vulnerabilities.
6 months ago
Kill Chain
UFP Technologies Cyberattack: A 2026 Data Theft Incident
In February 2026, UFP Technologies, a leading medical device manufacturer, detected unauthorized access to its IT systems. The breach, identified on February 14, led to the theft and potential destruction of company data, impacting critical functions such as billing and label creation for customer deliveries. Immediate containment measures were implemented, and external cybersecurity experts were engaged to investigate and remediate the incident. The company has since restored access to the affected information and believes the threat actor has been removed from its systems. This incident underscores the escalating cyber threats targeting the healthcare sector, emphasizing the need for robust cybersecurity measures. Organizations must remain vigilant against sophisticated attacks that can disrupt operations and compromise sensitive data, highlighting the importance of proactive defense strategies and incident response planning.
7 months ago
Kill Chain
Critical Vulnerabilities Discovered in Jinan USR IOT's USR-W610 Device
In February 2026, multiple critical vulnerabilities were identified in Jinan USR IOT Technology Limited's USR-W610 serial device server, affecting firmware versions up to and including 3.1.1.0. These vulnerabilities include weak password requirements, cleartext transmission of sensitive information, insufficiently protected credentials, and missing authentication for critical functions. Exploitation could lead to authentication bypass, denial-of-service conditions, or unauthorized access to user credentials, including administrative accounts. ([windowsforum.com](https://windowsforum.com/threads/high-severity-ics-advisory-hits-usr-w610-serial-gateway-cve-2026-25715-to-cve-2026-26048.402628/post-959899?utm_source=openai)) The USR-W610 is widely deployed in industrial environments to bridge legacy serial devices with IP-based networks. Given the device's role in critical manufacturing sectors, these vulnerabilities pose significant risks, including potential unauthorized process changes, production downtime, and safety incidents. ([windowsforum.com](https://windowsforum.com/threads/high-severity-ics-advisory-hits-usr-w610-serial-gateway-cve-2026-25715-to-cve-2026-26048.402628/post-959899?utm_source=openai))
7 months ago
Kill Chain
Critical Vulnerability in Valmet DNA Engineering Web Tools: CVE-2025-15577
In February 2026, a critical vulnerability (CVE-2025-15577) was identified in Valmet DNA Engineering Web Tools versions C2022 and earlier. This flaw allows unauthenticated attackers to manipulate URLs, enabling arbitrary file read access on the affected systems. Exploiting this vulnerability could lead to unauthorized access to sensitive information, posing significant risks to industrial control systems. ([valmet.com](https://www.valmet.com/company/innovation/advisories/CVE-2025-15577/?utm_source=openai)) The discovery of this vulnerability underscores the ongoing challenges in securing industrial control systems against cyber threats. Organizations utilizing Valmet DNA Web Tools are urged to apply the vendor-provided patches promptly and implement recommended security measures to mitigate potential exploitation. ([valmet.com](https://www.valmet.com/company/innovation/advisories/CVE-2025-15577/?utm_source=openai))
7 months ago
Kill Chain
Delta Electronics ASDA-Soft Vulnerability Exposes Critical Systems to Risk
In January 2026, Delta Electronics disclosed a critical stack-based buffer overflow vulnerability (CVE-2026-1361) in their ASDA-Soft software, versions up to 7.2.0.0. This flaw allows attackers to write arbitrary data beyond the bounds of a stack-allocated buffer, potentially leading to the corruption of a structured exception handler (SEH). Exploitation requires local access and user interaction, but no prior authentication, posing significant risks to confidentiality, integrity, and availability. Delta Electronics has released version 7.2.2.0 to address this issue. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-1361?utm_source=openai)) This incident underscores the persistent threat of buffer overflow vulnerabilities in industrial control systems, emphasizing the need for rigorous input validation and timely software updates to mitigate potential exploits.
7 months ago
Kill Chain
Critical Vulnerability in Open62541: Immediate Action Required
In February 2026, a medium-severity vulnerability (CVE-2026-1301) was identified in o6 Automation GmbH's Open62541, an open-source OPC UA stack widely used in industrial automation. The flaw, present in versions from 1.5-rc1 to before 1.5-rc2, allows unauthenticated attackers to send crafted JSON PubSub messages, leading to out-of-bounds writes, process crashes, and potential memory corruption. This vulnerability poses significant risks to industrial control systems, potentially causing operational disruptions and compromising system integrity. ([windowsforum.com](https://windowsforum.com/threads/cve-2026-1301-open62541-json-pubsub-memory-safety-bug-upgrade-to-v1-5-0.400263/?utm_source=openai)) The discovery of this vulnerability underscores the critical importance of rigorous security practices in industrial automation software. Organizations utilizing Open62541 should promptly upgrade to the stable release v1.5.0 to mitigate this risk. Additionally, implementing network segmentation and minimizing exposure of control systems to external networks are essential steps to enhance security posture. ([windowsforum.com](https://windowsforum.com/threads/cve-2026-1301-open62541-json-pubsub-memory-safety-bug-upgrade-to-v1-5-0.400263/?utm_source=openai))
7 months ago
Kill Chain
Mitsubishi Electric's 2026 PLC Vulnerability: A Wake-Up Call for Industrial Network Security
In February 2026, Mitsubishi Electric disclosed a critical vulnerability (CVE-2025-15080) in its MELSEC iQ-R Series programmable logic controllers (PLCs). This flaw allows unauthenticated attackers to read or modify device data and control programs, or to cause a denial-of-service condition by sending specially crafted packets. The affected models include R08PCPU, R16PCPU, R32PCPU, and R120PCPU with firmware versions up to 48. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-15080?utm_source=openai)) This incident underscores the persistent risks in industrial control systems, particularly those exposed to untrusted networks. Organizations must prioritize securing network access to critical infrastructure to prevent unauthorized exploitation of such vulnerabilities.
7 months ago
Kill Chain
Poland's Energy Sector Cyberattack: A Wake-Up Call for Critical Infrastructure Security
On December 29, 2025, coordinated cyberattacks targeted over 30 wind and photovoltaic farms, a manufacturing company, and a large combined heat and power plant in Poland. The attacks, attributed to the Russian state-sponsored group Static Tundra (also known as Berserk Bear or Dragonfly), aimed to disrupt energy infrastructure by deploying wiper malware designed to destroy data and disable systems. While the attacks caused communication disruptions, they did not interrupt energy production or heat supply to consumers. ([cert.pl](https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025/?utm_source=openai)) This incident underscores the escalating threat of nation-state cyberattacks on critical infrastructure, highlighting the need for enhanced cybersecurity measures and international cooperation to protect essential services from sophisticated adversaries.
7 months ago
Kill Chain
Rockwell Automation's ArmorStart LT Vulnerabilities: A Wake-Up Call for Industrial Security
In January 2026, Rockwell Automation disclosed multiple vulnerabilities in its ArmorStart® LT motor control devices, specifically models 290D, 291D, and 294D up to and including version V2.002. These vulnerabilities, identified as CVE-2025-9464 through CVE-2025-9283, can lead to denial-of-service conditions. Exploitation methods include fuzzing of CIP classes, execution of Achilles Comprehensive grammar tests, and active scanning with tools like Burp Suite, causing devices to become unresponsive or reboot unexpectedly. ([rockwellautomation.com](https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html?utm_source=openai)) The affected devices are widely used in the critical manufacturing sector globally. As of the disclosure, no patches or upgrades were available. Rockwell Automation recommends applying security best practices to mitigate risks, such as minimizing network exposure, placing devices behind firewalls, and using secure remote access methods like VPNs. ([rockwellautomation.com](https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html?utm_source=openai))
7 months ago
Kill Chain
2024 Critical Telnet Flaw: How Legacy Protocols Created a Global Attack Surface
In early 2024, security researchers uncovered a critical vulnerability affecting widely used Telnet server software running on hundreds of thousands of legacy and IoT devices worldwide. Attackers exploited the bug, which allowed unauthenticated remote access using unencrypted Telnet sessions, to compromise network and industrial systems, bypass access controls, and rapidly pivot laterally. Many affected devices remained unpatched due to lack of vendor support, making remediation difficult and exposing organizations in healthcare, manufacturing, and critical infrastructure to potential downtime and data theft. This incident highlights the enduring risk of forgotten, legacy protocols like Telnet persisting in enterprise environments. Attackers increasingly scan for and exploit such overlooked attack surfaces, emphasizing the need for proactive inventory, segmentation, and the retirement of obsolete network services to defend against emergent threats.
7 months ago
Kill Chain
Electrum-Linked Wiper Attack Disables Key Systems in Polish Energy Grid
In late December 2025, a coordinated cyberattack targeted Poland’s distributed energy resource (DER) sites, including combined heat and power, wind, and solar dispatch facilities. The attackers, identified as the Russian-linked Electrum (overlapping with APT44/Sandworm), exploited misconfigurations and exposed operational technology, corrupting or destroying key OT and Windows systems at nearly 30 sites. While no electrical outages were reported and power generation largely continued, remote monitoring and control capabilities were disabled and some equipment rendered inoperable, exposing critical vulnerabilities in Poland’s decentralized energy grid. This incident highlights a significant evolution in threat actor tactics toward industrial systems, specifically targeting the backbone of modern hybrid energy infrastructure. Increased focus on OT security, zero-trust segmentation, and resilient operational controls is crucial as sophisticated groups continue probing for weaknesses in vital infrastructure globally.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports