The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Industrial Automation
Breach intelligence, attack campaigns, and threat reports targeting the Industrial Automation sector.
Explore Other Sectors
Industrial Automation Threat Reports
Attackers Exploit GNU InetUtils Telnetd Flaw for Root Access in 2026
In January 2026, researchers discovered active exploitation of a critical eleven-year-old authentication bypass vulnerability (CVE-2026-24061) in the GNU InetUtils telnetd server, affecting versions 1.9.3 through 2.7. Attackers leveraged unsanitized environment variable handling to pass 'USER=-f root' via Telnet connections, trivially gaining root shell access without authentication. While identified exploitation was limited—18 unique IPs targeting 60 sessions over two days—many affected systems are legacy or embedded industrial and IoT devices, complicating patching or replacement and increasing exposure risk in Operational Technology (OT) environments. This incident highlights how long-standing vulnerabilities in rarely updated legacy software can be weaponized by both automated and hands-on attackers. The persistence of Telnet in OT, IoT, and embedded sectors, combined with publicly available exploits, underscores increased urgency for organizations to identify, mitigate, or segment such outdated services before broader exploitation occurs.
8 months ago
Kill Chain
Rockwell Automation Verve Asset Manager Vulnerabilities: 2026 Lessons for Critical Infrastructure
In January 2026, Rockwell Automation disclosed two significant vulnerabilities (CVE-2025-14376, CVE-2025-14377) in its Verve Asset Manager product. These flaws were rooted in insecure and cleartext storage of sensitive data within the legacy ADI server and Ansible playbook components, impacting versions 1.33 through 1.41.3. Exploitation could have allowed attackers with system or network access to retrieve confidential data from environment variables and process files, potentially facilitating lateral movement or further compromises. The issues were addressed in version 1.42, and vulnerable components were made optional in newer releases. This incident is particularly relevant amid heightened attention to supply chain risk and critical infrastructure cybersecurity. As industrial control vendors face rising regulatory pressure and expansion of zero-trust mandates, unencrypted data storage flaws highlight the urgent need for comprehensive data-in-transit and at-rest protections.
8 months ago
Kill Chain
Siemens Edge Device Vulnerability Exposes Critical Manufacturing Operations in 2026
In January 2026, Siemens disclosed a critical authorization bypass vulnerability (CVE-2025-40805) affecting a broad range of its Industrial Edge Devices and operator panels. The flaw allows an unauthenticated remote attacker to circumvent user authentication by exploiting weaknesses in certain API endpoints, enabling impersonation of legitimate users. Exploitation requires knowledge of a valid user identity. Siemens promptly released patches and mitigation recommendations for impacted devices, but multiple models remain without fixes as of the initial disclosure, heightening operational risk in environments relying on these devices. This incident underscores the ongoing threat posed by API weaknesses and identity-driven attacks in critical manufacturing and operational technology sectors. As API-driven automation proliferates in industry, organizations must rapidly address such vulnerabilities in devices that underpin essential infrastructure.
8 months ago
Kill Chain
Siemens SINEC Security Monitor: 2025 Vulnerabilities Expose Industrial OT Risks
In December 2025, Siemens disclosed two medium-severity vulnerabilities (CVE-2025-40830 and CVE-2025-40831) affecting SINEC Security Monitor software prior to version 4.10.0. The first vulnerability allows authenticated, low-privileged local users to bypass authorization controls and read or write arbitrary files on the server or sensor, potentially resulting in data tampering or unauthorized access. The second flaw enables an authenticated low-privileged attacker to cause a denial of service in the reporting module through improper input validation. Siemens and CISA recommend upgrading to version 4.10.0 and strongly advise hardening network access to affected devices. This incident highlights the ongoing risks posed by privilege escalation and input validation flaws, especially in critical infrastructure management software. As regulatory scrutiny over operational technology intensifies and attackers increasingly exploit supply chain and lateral movement techniques, maintaining timely patching and rigorous security baselines is essential to minimize the risk of compromise.
8 months ago
Kill Chain
Critical Authorization Bypass Hits Siemens Industrial Edge in 2026
In January 2026, Siemens disclosed a critical vulnerability (CVE-2025-40805) affecting the Industrial Edge Device Kit line for both arm64 and x86-64 architectures. The flaw, present in numerous firmware versions, allows unauthenticated remote attackers to bypass user authentication on specific API endpoints by exploiting an authorization weakness. An attacker who learns a legitimate user’s identity could leverage this to impersonate that user and gain illicit control or visibility within industrial environments. Siemens promptly released security updates and mitigation guidance for impacted devices, urging organizations to update or restrict network access as a preventive measure. This incident highlights increasing risks to operational technology (OT) and critical infrastructure, as authentication flaws in widely deployed industrial solutions can expose factories and utilities globally. The CVE underscores growing threats facing manufacturing, regulatory pressure for timely patching, and ongoing urgency for zero trust controls in industrial systems.
8 months ago
Kill Chain
Siemens 2026: Denial-of-Service Flaw Impacts SIMATIC & SIPLUS ICS Devices
In January 2026, Siemens publicly disclosed a denial-of-service vulnerability (CVE-2025-40944) impacting multiple SIMATIC and SIPLUS products used widely in critical manufacturing environments. The flaw allows an attacker to send a specially crafted S7 protocol Disconnect Request (COTP DR TPDU) over TCP port 102, which causes affected devices to become unresponsive, requiring a physical power cycle to restore service. While some products have received security updates, many still await permanent fixes. Incident response measures include network segmentation and port filtering to mitigate risk, as exploitation could disrupt operational technology and industrial control systems worldwide. This incident is especially relevant amid the ongoing focus on industrial cyber defenses, as threat actors increasingly target operational technology. The vulnerability highlights persistent risks from protocol weaknesses and layered third-party supply chains, underscoring the importance of proactive risk management, segmentation, and maintaining up-to-date mitigations in ICS environments.
8 months ago
Kill Chain
Delta PLC Vulnerabilities: How 2024’s Critical Flaws Put Industrial Operations at Risk
In June 2024, security researchers publicly disclosed three critical vulnerabilities in Delta Electronics' industrial PLC (Programmable Logic Controller) products, which are widely used across global manufacturing, energy, and automation sectors. These flaws allow remote attackers to bypass authentication, execute arbitrary code, and disrupt operational processes if exploited. While no in-the-wild attacks have been reported to date, the vulnerabilities could grant adversaries broad control over industrial systems and potentially lead to industrial sabotage or production halts. Delta Electronics has released security patches and advisories to help customers mitigate risks. This disclosure is significant because ICS-targeted attacks have increased in sophistication and frequency, exposing the strategic risks of legacy and industrial devices. Critical infrastructure organizations face urgent pressure to update and segment exposed controllers, reinforcing the necessity for real-time threat detection and Zero Trust policies to thwart emerging OT threats.
8 months ago
Kill Chain
Rockwell Automation ICS Devices Exposed by Critical DoS Vulnerability (CVE-2025-9368)
In January 2026, Rockwell Automation disclosed a critical vulnerability (CVE-2025-9368) affecting its 432ES-IG3 Series A industrial Ethernet/IP interface. The flaw, classified as a resource allocation vulnerability (CWE-770), can be exploited remotely to cause a denial-of-service (DoS) condition, rendering the device unresponsive and requiring manual power cycling to restore operations. The vulnerability affects version V1.001 of the device, widely deployed in critical manufacturing environments worldwide. No evidence of active exploitation has been reported as of the initial CISA advisory, but the risk of service disruption in operational technology (OT) networks is significant. This incident underscores the persistent threat posed by resource exhaustion flaws in industrial control systems, as attackers continue to seek low-complexity, high-impact vulnerabilities to disrupt critical infrastructure. With global regulatory focus increasing and ICS-targeted attacks on the rise, addressing resource and availability issues has become a pressing operational and compliance priority for manufacturers and critical infrastructure operators.
8 months ago
Kill Chain
Rockwell Automation DataMosaix SQL Injection Exposes Critical Manufacturing Systems
In January 2026, Rockwell Automation disclosed a critical vulnerability in its FactoryTalk DataMosaix Private Cloud platform affecting versions 7.11, 8.00, and 8.01. Identified as CVE-2025-12807, this SQL Injection flaw allows low-privilege users to execute unauthorized sensitive database operations through exposed API endpoints. While no public exploitation has been reported, successful attacks could significantly compromise critical manufacturing infrastructure worldwide by enabling attackers to access or manipulate sensitive industrial data. The incident highlights ongoing risks to industrial control environments from common vulnerabilities like SQL Injection, especially in products globally deployed across critical infrastructure sectors. With attackers increasingly targeting OT platforms, organizations face renewed urgency to review security controls and ensure compliance with updated defensive best practices.
8 months ago
Kill Chain
Critical RCE Flaw in Hitachi Energy Asset Suite: Jasper Report Vulnerability Exposes Critical Infrastructure (2025)
In December 2025, Hitachi Energy disclosed a critical remote code execution (RCE) vulnerability (CVE-2025-10492) affecting its Asset Suite product versions 9.7 and prior. The flaw, found in the Jasper Report third-party component, arises from improper deserialization of untrusted data, allowing attackers to remotely execute arbitrary code on affected systems. The vulnerability particularly impacts organizations using Asset Suite in critical infrastructure sectors, such as energy, potentially exposing operational networks to severe risks of compromise, data breach, or service disruption. This incident underscores the persistent threat posed by supply chain vulnerabilities in industrial control software. As threat actors increasingly target critical infrastructure through third-party and open-source components, organizations face heightened regulatory scrutiny and an urgent need for robust patch and mitigation strategies to close compliance and security gaps.
8 months ago
Kill Chain
27 Malicious npm Packages Turn Dev Ecosystem Into Phishing Playground in 2025
In late 2025, security researchers uncovered a sophisticated supply chain attack leveraging the npm package ecosystem to execute a targeted spear-phishing campaign. Over a five-month period, attackers published 27 malicious npm packages via six aliases, using content delivery networks to host and serve browser-based phishing lures. These lures mimicked document-sharing and Microsoft sign-in portals to trick targeted sales and commercial staff at 25 organizations across manufacturing, industrial automation, healthcare, and allied sectors in the US and Europe. The campaign incorporated advanced anti-analysis checks, obfuscated JavaScript, and honeypot detection to evade security tooling, with hardcoded targets likely sourced from trade show and open-sourced company data. This incident exemplifies the growing abuse of public developer ecosystems and infrastructure in credential theft operations, highlighting an urgent need for organizations to monitor software supply chains and enforce modern, phishing-resistant controls. Attackers' use of legitimate distribution services as resilient hosting and focus on regional, non-IT staff illustrate shifting tactics in supply chain and social engineering threats.
8 months ago
Kill Chain
ICS in Crisis: Multi-Vector Malware Campaign Hits Industrial Automation Sector in Q3 2025
In Q3 2025, a coordinated multi-vector malware campaign targeted the global industrial automation sector, exploiting both internet-borne and lateral movement vectors to infiltrate sensitive OT environments. Malicious scripts, phishing pages, and spyware were delivered through malicious emails and compromised websites, with attackers leveraging old vulnerabilities in software such as Microsoft Office Equation Editor (CVE-2017-11882) to gain persistent access. The incident impacted biometrics, engineering, and manufacturing industries, affecting up to 27.4% of ICS computers in certain regions, and enabled the delivery of ransomware, spyware, and self-propagating worms across distributed networks. This incident is notable for its breadth—over 11,000 malware families were detected—and its use of diverse channels, from web to USB to network shares. The surge in initial infection via malicious scripts and documents, especially in East Asia and South America, demonstrates attackers’ evolving tactics and the urgent need for improved segmentation, encrypted network traffic, and anomaly detection across critical OT environments.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports