Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Industrial Automation

Breach intelligence, attack campaigns, and threat reports targeting the Industrial Automation sector.

298 threat reports
Page 4 of 25
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Industrial Automation Threat Reports

Showing 37–48 / 298 reports
Critical Authentication Bypass in Siemens Industrial Edge Management Exposes Global Manufacturing Infrastructure
Critical Authentication Bypass in Siemens Industrial Edge Management Exposes Global Manufacturing Infrastructure
Industrial Automation1 month ago

Critical Authentication Bypass in Siemens Industrial Edge Management Exposes Global Manufacturing Infrastructure

In September 2026, CISA published an advisory regarding a critical authentication bypass vulnerability (CVE-2026-18963) affecting Siemens Industrial Edge Management systems worldwide. The vulnerability, with a CVSS score of 9.1, allows unauthenticated remote attackers to perform complete account takeovers by exploiting the password reset mechanism without requiring email verification. The flaw affects multiple versions of Industrial Edge Management Cloud, Pro V1, Pro V2, and Virtual editions used in critical manufacturing environments globally. Siemens has released patches and implemented firewall rules to mitigate the threat. This incident highlights the growing threat landscape targeting industrial control systems and critical infrastructure, particularly as organizations increasingly adopt cloud-connected industrial IoT platforms. The vulnerability's high severity and potential for complete account compromise underscores the urgent need for robust authentication mechanisms and zero-trust security models in operational technology environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Critical XSS Vulnerability in OpenPLC Runtime v3 Threatens Industrial Control Systems
Critical XSS Vulnerability in OpenPLC Runtime v3 Threatens Industrial Control Systems
Oil/Energy/Solar/Greentech1 month ago

Critical XSS Vulnerability in OpenPLC Runtime v3 Threatens Industrial Control Systems

A critical cross-site scripting (XSS) vulnerability (CVE-2026-88020) was discovered in OpenPLC Runtime v3, an open-source programmable logic controller platform used across critical infrastructure sectors including manufacturing, energy, transportation, and water systems. The vulnerability allows attackers to hijack session cookies and issue state-changing requests as operators, potentially enabling unauthorized control of industrial processes and physical systems. With a CVSS score of 6.1, the flaw stems from improper input neutralization in the web interface's query string parameter handling, affecting the end-of-life OpenPLC v3 platform deployed worldwide. This vulnerability highlights the growing cybersecurity risks facing industrial control systems as they become increasingly connected to corporate networks and the internet. The convergence of IT and OT security challenges continues to expand the attack surface for critical infrastructure, making legacy industrial systems attractive targets for nation-state actors and cybercriminals seeking to disrupt essential services.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical Vulnerabilities Disclosed in Hitachi Energy Power Grid Control Systems
Critical Vulnerabilities Disclosed in Hitachi Energy Power Grid Control Systems
Oil/Energy/Solar/Greentech1 month ago

Critical Vulnerabilities Disclosed in Hitachi Energy Power Grid Control Systems

CISA published advisory ICSA-26-260-03 disclosing critical vulnerabilities in Hitachi Energy's FACTS Control Platform (FCP) affecting multiple versions from 3.4.0 to 4.1.1 when deployed with the GWS component. The vulnerabilities include SQL injection (CVE-2024-4872), path traversal (CVE-2024-3980), session hijacking (CVE-2024-3982), missing authentication (CVE-2024-7940), and open redirect (CVE-2024-7941) with CVSS scores ranging from 4.3 to 9.9. These flaws could allow authenticated attackers to execute code injection, access critical system files, hijack sessions, and redirect users to malicious sites, potentially compromising the confidentiality, integrity, and availability of critical power grid infrastructure. This disclosure highlights the growing cybersecurity challenges facing operational technology in the energy sector, particularly as industrial control systems become increasingly connected and targeted by sophisticated threat actors seeking to disrupt critical infrastructure operations.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical Authentication Bypass in Mitsubishi Electric GX Works3 Exposes Industrial Control Systems
Critical Authentication Bypass in Mitsubishi Electric GX Works3 Exposes Industrial Control Systems
Industrial Automation1 month ago

Critical Authentication Bypass in Mitsubishi Electric GX Works3 Exposes Industrial Control Systems

In September 2026, CISA disclosed CVE-2026-15688, a critical authentication bypass vulnerability in Mitsubishi Electric's GX Works3 and Motion Control Settings software used in industrial control systems worldwide. The vulnerability, scored 8.8 (CVSS v3.1) and 9.2 (CVSS v4.0), allows local attackers to bypass block password authentication by modifying executable modules in memory, enabling unauthorized access to view, tamper with, destroy, or delete control programs in critical manufacturing environments. This incident highlights the growing threat landscape targeting industrial control systems as cyber adversaries increasingly focus on critical infrastructure. With ICS environments becoming more connected and the rise of sophisticated state-sponsored attacks on manufacturing facilities, authentication vulnerabilities in widely-deployed engineering software represent significant risks to operational technology security and industrial resilience.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Siemens Reyrolle 7SR5 Vulnerabilities Threaten Power Grid Security
Utilities1 month ago

Critical Siemens Reyrolle 7SR5 Vulnerabilities Threaten Power Grid Security

Siemens Reyrolle 7SR5 protection relay systems before version 2.70 are affected by 14 critical vulnerabilities, including authentication bypass, session hijacking, and buffer overflow conditions. These vulnerabilities in the Cesanta Mongoose Web Server component allow unauthenticated remote attackers to gain administrative access, execute arbitrary code, and cause denial-of-service conditions on critical power grid protection equipment deployed worldwide. The highest severity vulnerability (CVE-2026-62645) achieves a CVSS score of 9.8, enabling complete system compromise through predictable session identifiers and missing authentication controls. These vulnerabilities highlight the growing cybersecurity risks in operational technology (OT) environments, particularly as critical infrastructure becomes increasingly connected and exposed to network-based attacks targeting industrial control systems.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical XSS Vulnerability in Siemens Teamcenter Exposes Manufacturing Systems to Web-Based Attacks
Automotive1 month ago

Critical XSS Vulnerability in Siemens Teamcenter Exposes Manufacturing Systems to Web-Based Attacks

A reflected cross-site scripting (XSS) vulnerability (CVE-2026-58113) was discovered in Siemens Teamcenter's authentication redirect flow, affecting multiple versions across V2412, V2506, V2512, and V2606 product lines. The vulnerability allows unauthenticated remote attackers to inject malicious JavaScript into authenticated user sessions through crafted URLs, potentially enabling data theft and unauthorized actions within victims' Teamcenter sessions. Siemens has released patches for all affected versions and recommends immediate updates to mitigate the CVSS 6.1 rated vulnerability. This incident highlights the persistent threat of web application vulnerabilities in critical manufacturing systems, particularly as organizations increasingly rely on web-based PLM platforms for sensitive industrial operations and intellectual property management.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical Vulnerability in Schneider Electric SCADAPack x70 Systems Exposes Industrial Infrastructure
Oil/Energy/Solar/Greentech1 month ago

Critical Vulnerability in Schneider Electric SCADAPack x70 Systems Exposes Industrial Infrastructure

Schneider Electric disclosed a critical vulnerability (CVE-2026-81861) affecting all versions of its SCADAPack x70 Remote Terminal Units used in critical infrastructure worldwide. The insufficiently protected credentials vulnerability could allow unauthorized access to RTU configuration through the legacy Secure Lock functionality, potentially compromising confidentiality of industrial control systems. The vulnerability affects SCADAPack 47x, 47xi, 47xd, 470R, 57x, 3xx, and 32 products deployed globally in critical manufacturing and energy sectors. Industrial control system vulnerabilities continue to represent a significant threat vector as critical infrastructure increasingly becomes a target for nation-state actors and ransomware groups seeking to disrupt essential services and cause maximum societal impact.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft Warns of Critical Security Gaps in Edge AI Deployments
Microsoft Warns of Critical Security Gaps in Edge AI Deployments
Health Care / Life Sciences2 months ago

Microsoft Warns of Critical Security Gaps in Edge AI Deployments

Microsoft published a comprehensive security advisory in September 2024 addressing critical vulnerabilities in Edge AI deployments where machine learning models execute on customer-owned infrastructure. The advisory highlights fundamental security model changes when AI systems move from centralized cloud services to edge environments, exposing organizations to prompt injection attacks, model tampering, and malicious firmware updates. Customer-owned Edge AI deployments face increased attack surfaces as models, credentials, and sensitive data operate in potentially hostile environments outside cloud providers' direct security controls. This advisory emerges as organizations rapidly adopt Edge AI for cost optimization, data sovereignty, and reduced latency, creating new attack vectors that traditional software security controls cannot adequately address.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical Buffer Overflow Vulnerability CVE-2026-78012 Threatens Industrial Control Systems
Critical Buffer Overflow Vulnerability CVE-2026-78012 Threatens Industrial Control Systems
Industrial Automation2 months ago

Critical Buffer Overflow Vulnerability CVE-2026-78012 Threatens Industrial Control Systems

In September 2026, CISA disclosed CVE-2026-78012, a critical stack-based buffer overflow vulnerability in Pyramid Solutions NetStaX EtherNet/IP Stack affecting versions prior to 5.6.1. The vulnerability allows attackers to send large Class 3 explicit-message requests that exceed application-side receive buffers without generating error warnings, potentially leading to memory corruption, device crashes, or remote code execution. With a CVSS score of 9.8, this flaw impacts multiple industrial control systems across critical infrastructure sectors including manufacturing, energy, water treatment, and chemical facilities worldwide. The vulnerability represents a significant threat to operational technology environments where these industrial communication stacks are widely deployed. This incident highlights the growing cybersecurity risks facing industrial control systems as OT networks become increasingly connected and targeted by sophisticated threat actors, making secure industrial communication protocols and robust buffer management critical for protecting critical infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical VPN Vulnerability CVE-2026-75925 Exposes Infrastructure to Remote Code Execution
Critical VPN Vulnerability CVE-2026-75925 Exposes Infrastructure to Remote Code Execution
Industrial Automation2 months ago

Critical VPN Vulnerability CVE-2026-75925 Exposes Infrastructure to Remote Code Execution

In August 2026, CISA disclosed CVE-2026-75925, a critical CRLF injection vulnerability in IXON VPN Client versions prior to 1.4.7 with a CVSS score of 9.6. The vulnerability allows remote attackers to execute commands with root or SYSTEM privileges by injecting malicious configuration directives through unvalidated line-ending sequences. The flaw stems from improper neutralization of CRLF sequences in configuration values written to files consumed by privileged subprocesses, combined with lack of authentication for configuration changes. IXON responded by automatically rejecting connections from vulnerable client versions and releasing patches, preventing exploitation on unpatched systems that cannot establish VPN connections. This incident highlights the growing sophistication of infrastructure-targeted attacks and the critical importance of secure coding practices in VPN solutions that organizations rely on for remote access security.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Vulnerabilities Expose Rockwell Automation Industrial Control Systems to Remote Attacks
Critical Vulnerabilities Expose Rockwell Automation Industrial Control Systems to Remote Attacks
Industrial Automation2 months ago

Critical Vulnerabilities Expose Rockwell Automation Industrial Control Systems to Remote Attacks

CISA disclosed two critical vulnerabilities (CVE-2026-19471, CVE-2026-19472) affecting Rockwell Automation's ArmorStart LT motor protection devices version 2.001 and earlier. CVE-2026-19471 involves stored cross-site scripting (XSS) vulnerabilities that allow attackers to inject malicious scripts executed when users access affected web pages. CVE-2026-19472 is a denial-of-service vulnerability triggered by crafted HTTP PUT requests that can disable the embedded web server. Both vulnerabilities require no authentication and can be exploited remotely, potentially compromising industrial control systems used in critical manufacturing worldwide. These vulnerabilities highlight the growing attack surface of industrial IoT devices and the critical need for secure-by-design principles in operational technology environments, especially as industrial systems become increasingly connected to enterprise networks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical OT Vulnerability Exposes Industrial Control Systems to Code Execution Attacks
Critical OT Vulnerability Exposes Industrial Control Systems to Code Execution Attacks
Industrial Automation2 months ago

Critical OT Vulnerability Exposes Industrial Control Systems to Code Execution Attacks

Rockwell Automation's ControlFLASH software versions 15.07 and earlier contain a critical vulnerability (CVE-2026-12663) that grants write permissions to the 'Everyone' group on installation directories. This security flaw allows attackers to execute arbitrary code at the logged-in user's permission level, potentially compromising industrial control systems across critical infrastructure sectors including manufacturing, energy, and water systems. The vulnerability stems from missing authentication for critical functions and affects installations worldwide. Rockwell has released version 15.08 to address this issue and provided manual mitigation steps for systems that cannot immediately upgrade. This incident highlights the growing cybersecurity risks facing operational technology (OT) environments as industrial systems become increasingly connected and targeted by threat actors seeking to disrupt critical infrastructure operations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports