Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Industrial Automation

Breach intelligence, attack campaigns, and threat reports targeting the Industrial Automation sector.

298 threat reports
Page 5 of 25
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Industrial Automation Threat Reports

Showing 49–60 / 298 reports
Critical Vulnerabilities in Tycon Systems Industrial Monitoring Devices Threaten Infrastructure Security
Critical Vulnerabilities in Tycon Systems Industrial Monitoring Devices Threaten Infrastructure Security
Oil/Energy/Solar/Greentech2 months ago

Critical Vulnerabilities in Tycon Systems Industrial Monitoring Devices Threaten Infrastructure Security

In September 2026, CISA disclosed three critical vulnerabilities (CVE-2026-77847, CVE-2026-82712, CVE-2026-82684) affecting Tycon Systems TPDIN-Monitor-WEB3 industrial control system devices version 2.2.9 and prior. These vulnerabilities include hard-coded credentials, cross-site request forgery, and missing authorization controls that could enable attackers to perform man-in-the-middle attacks, extract system credentials, cause factory resets, or retrieve sensitive operational data from critical infrastructure systems deployed worldwide in energy and manufacturing sectors. These vulnerabilities highlight the ongoing security challenges in operational technology environments where legacy authentication models and insufficient access controls create attack vectors that could disrupt critical infrastructure operations and expose sensitive industrial data.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Configuration Flaw Exposed in Inductive Automation Ignition SCADA Platform
Critical Configuration Flaw Exposed in Inductive Automation Ignition SCADA Platform
Industrial Automation2 months ago

Critical Configuration Flaw Exposed in Inductive Automation Ignition SCADA Platform

In September 2026, CISA disclosed CVE-2026-77393 affecting Inductive Automation's Ignition SCADA platform versions 8.1.53 and earlier. The vulnerability stems from incorrect default permissions where the Gateway's 'Create Project Role(s)' setting shipped blank, allowing any authenticated user to create projects if they could execute gateway scripts. This configuration flaw exposed industrial control systems to potential unauthorized project creation and manipulation. Inductive Automation addressed the issue in version 8.1.54 by restricting project creation to Designer sessions and eliminating reliance on the problematic setting. This incident highlights the growing security challenges facing industrial control systems as they become increasingly connected and targeted by threat actors. With critical infrastructure under constant threat and new regulations emphasizing OT security, even seemingly minor configuration vulnerabilities can create significant exposure points for manufacturing and energy sector organizations.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
AI Weaponizes PLC Exploits: How Claude Ported Critical Infrastructure Attacks
Utilities2 months ago

AI Weaponizes PLC Exploits: How Claude Ported Critical Infrastructure Attacks

In September 2026, Forescout's Vedere Labs demonstrated how Anthropic's Claude AI successfully ported a pre-authentication remote code execution exploit targeting CVE-2021-31886 from one WAGO programmable logic controller model to another. The research consumed $535.74 in API costs over 8.5 hours to adapt an existing 750-852 exploit for the 750-831 controller, exploiting a stack-based buffer overflow in the Nucleus FTP server with a CVSS score of 9.8. The AI-assisted exploit development achieved code execution by sending network packets, though a subsequent attempt to create a command-and-control implant permanently bricked the target PLC by writing to flash memory. This research highlights the evolving threat landscape where AI tools are lowering the technical barriers for developing industrial control system exploits, coinciding with recent warnings from NSA, CISA, and FBI about AI-generated scripts targeting Siemens PLCs and ongoing attacks against water utility infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Critical Privilege Escalation Flaw Exposes Industrial Control Systems to Complete Compromise
Industrial Automation2 months ago

Critical Privilege Escalation Flaw Exposes Industrial Control Systems to Complete Compromise

A critical privilege escalation vulnerability (CVE-2026-16675) was discovered in Rockwell Automation's FactoryTalk Activation Manager V5.02 and below, affecting industrial control systems worldwide. The vulnerability allows authenticated attackers to hijack console windows during installation or repair operations, escalating from standard user privileges to SYSTEM-level access with complete control over affected systems. This poses significant risks to critical manufacturing infrastructure, as attackers can access all files, processes, and system resources once exploited. This vulnerability highlights the ongoing security challenges facing industrial control systems as manufacturing environments become increasingly digitized and interconnected, making them attractive targets for cybercriminals and nation-state actors seeking to disrupt critical infrastructure operations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Critical Privilege Escalation Vulnerabilities Discovered in Rockwell Automation Industrial Systems
Industrial Automation2 months ago

Critical Privilege Escalation Vulnerabilities Discovered in Rockwell Automation Industrial Systems

In September 2026, CISA disclosed two critical privilege escalation vulnerabilities (CVE-2026-9633 and CVE-2026-9634) in Rockwell Automation's Redundancy Module Configuration Tool affecting versions 9.00.00 through 10.00.00. The vulnerabilities stem from incorrect default permissions that allow the tool's executables to search for required DLLs in directories writable by standard users. If exploited, local attackers can place malicious DLLs in these directories, which are then loaded with Administrator/SYSTEM privileges when the tool is run by an administrator. Rockwell Automation has released version 10.01.00 to address these issues, affecting critical manufacturing infrastructure worldwide. This incident highlights the persistent threat of DLL hijacking attacks in industrial control systems, particularly as organizations modernize their operational technology environments. With increasing convergence of IT and OT networks, such privilege escalation vulnerabilities pose significant risks to critical infrastructure security and operational continuity.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Critical Denial of Service Vulnerability Exposes Rockwell Automation Industrial Controllers
Industrial Automation2 months ago

Critical Denial of Service Vulnerability Exposes Rockwell Automation Industrial Controllers

Rockwell Automation disclosed CVE-2021-42260, a high-severity denial of service vulnerability affecting ControlLogix, CompactLogix, GuardLogix, and Compact GuardLogix controllers. The vulnerability, with a CVSS score of 7.5, allows attackers to trigger an infinite loop condition through corrupt crafted data, causing major nonrecoverable faults (MNRF) in safety controllers and requiring program downloads for recovery. The flaw impacts multiple firmware versions across the 34.x, 35.x, 36.x, and 37.x series, affecting critical manufacturing infrastructure deployed worldwide. This vulnerability highlights the ongoing risks to operational technology environments where denial of service attacks can cause significant operational disruption. As industrial control systems become increasingly connected and targeted by threat actors, vulnerabilities like CVE-2021-42260 demonstrate the critical need for robust OT security measures and timely patch management in manufacturing environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
Critical DOS Vulnerabilities Threaten Rockwell Automation RSLinx Classic Industrial Systems
Industrial Automation2 months ago

Critical DOS Vulnerabilities Threaten Rockwell Automation RSLinx Classic Industrial Systems

Four critical denial-of-service vulnerabilities (CVE-2026-9621, CVE-2026-9622, CVE-2026-9624, CVE-2026-9625) were discovered in Rockwell Automation's RSLinx Classic versions 4.50 and earlier. These vulnerabilities allow attackers to crash the RSLinx Classic service by sending specially crafted CIP packets, exploiting integer overflow, integer underflow, and buffer overflow conditions. The vulnerabilities affect critical manufacturing infrastructure worldwide and require service restarts to recover, potentially disrupting industrial operations and production systems. These vulnerabilities highlight the growing threat landscape facing industrial control systems as cybercriminals increasingly target critical infrastructure. With the rise of nation-state actors and ransomware groups focusing on OT environments, securing industrial communication protocols like CIP has become paramount for operational resilience.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
Critical Vulnerabilities Expose Rockwell Automation Industrial Systems to Remote Attacks
Industrial Automation2 months ago

Critical Vulnerabilities Expose Rockwell Automation Industrial Systems to Remote Attacks

In September 2026, CISA disclosed critical vulnerabilities in Rockwell Automation's FactoryTalk Historian Machine Edition affecting Series B 5.202 and Series C 7.101. CVE-2025-12768, with a CVSS score of 8.0, enables remote code execution through an out-of-bounds write condition exploitable by attackers with low-level authentication. CVE-2026-12661 allows denial-of-service attacks via stack-based buffer overflows when crafted requests are sent to the web interface, potentially crashing industrial systems. These vulnerabilities impact critical infrastructure sectors including chemical manufacturing, healthcare, and water systems worldwide. The disclosure emphasizes the growing threat landscape targeting industrial control systems and operational technology environments. Similar buffer overflow vulnerabilities in ICS components have been increasingly exploited by nation-state actors and ransomware groups to disrupt critical infrastructure operations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical Flaws in Ebyte Industrial Gateways Expose Global Infrastructure to Remote Attacks
Industrial Automation2 months ago

Critical Flaws in Ebyte Industrial Gateways Expose Global Infrastructure to Remote Attacks

In August 2026, CISA disclosed thirteen critical vulnerabilities in the Ebyte NA111-M industrial control system device, a Chinese-manufactured gateway used worldwide in critical infrastructure. The vulnerabilities include missing authentication, cleartext transmission of sensitive data, client-side authentication bypass, and weak cryptographic implementations. With CVSS scores up to 9.8, these flaws allow complete device compromise through remote exploitation, enabling attackers to access sensitive configurations, modify device settings, intercept MQTT credentials, and disrupt industrial operations. This disclosure highlights the persistent challenge of securing legacy industrial control systems that lack fundamental security controls, as nation-state actors and cybercriminals increasingly target critical infrastructure through vulnerable ICS devices for espionage and operational disruption.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical Password Hash Vulnerability Exposes Rockwell Automation Fleet Management Systems
Industrial Automation2 months ago

Critical Password Hash Vulnerability Exposes Rockwell Automation Fleet Management Systems

Rockwell Automation's OTTO Fleet Manager versions 2.36.2 and earlier contain a critical vulnerability (CVE-2026-75112) involving insufficient computational effort in bcrypt password hashing implementation. This weakness reduces the computational cost for attackers to perform offline brute-force attacks against stored password hashes if they gain access to unencrypted system backups. The vulnerability affects industrial fleet management systems used worldwide in critical manufacturing and transportation sectors, with Rockwell Automation releasing version 2.36.3 to address the issue. This incident highlights the growing threat to industrial control systems and the critical importance of proper cryptographic implementations in operational technology environments, particularly as threat actors increasingly target industrial infrastructure with sophisticated attack techniques.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical Security Flaws Expose Unitree Humanoid Robots to Remote Takeover
Industrial Automation2 months ago

Critical Security Flaws Expose Unitree Humanoid Robots to Remote Takeover

Security researcher Olivier Laflamme disclosed two critical root remote code execution vulnerabilities affecting Unitree G1 EDU humanoid robots in August 2026. CVE-2026-76639 exploits a path traversal flaw in the chat_go component to reach bashrunner, while CVE-2026-76640 enables Bluetooth Low Energy attacks that can compromise the robot's Locomotion PC without pairing. The vulnerabilities allowed attackers to gain root access through network-adjacent attacks or proximity-based Bluetooth exploitation, with Unitree partially addressing cloud authorization issues in July 2026 but leaving firmware patches unconfirmed. This incident highlights the growing security risks in autonomous robotics and IoT devices as they become more prevalent in industrial and consumer environments. The combination of wireless attack vectors and critical system access demonstrates the urgent need for robust security frameworks in next-generation robotic platforms.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
Industrial Automation Under Siege: Q2 2026 Threat Landscape Analysis
Industrial Automation2 months ago

Industrial Automation Under Siege: Q2 2026 Threat Landscape Analysis

In Q2 2026, Kaspersky's industrial threat landscape report revealed a significant shift in cybersecurity threats targeting industrial control systems (ICS), with malicious objects blocked on 19.15% of ICS computers—the lowest level since 2022. The report identified 10,904 different malware families affecting industrial automation systems, with malicious scripts and phishing pages leading threat categories at 5.42% globally. Notable regional variations emerged, with Africa showing the highest attack rates at 27.9% while Northern Europe recorded the lowest at 8.1%. The biometrics sector faced the most severe threats at 26.44%, experiencing increases across multiple threat vectors including ransomware, spyware, and malicious documents. This trend reflects the evolving sophistication of threat actors targeting critical infrastructure, coinciding with increased adoption of cloud-native industrial systems and the expansion of attack surfaces through IoT integration. The data highlights growing concerns around industrial cybersecurity as nation-state actors and cybercriminal groups increasingly focus on operational technology environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports