✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Machinery
Breach intelligence, attack campaigns, and threat reports targeting the Machinery sector.
Explore Other Sectors
Machinery Threat Reports
Critical DoS Vulnerability in Mitsubishi Electric's MELSEC iQ-F Series FX5-ENET/IP Module (CVE-2026-1876)
In March 2026, Mitsubishi Electric disclosed a high-severity denial-of-service (DoS) vulnerability (CVE-2026-1876) in its MELSEC iQ-F Series FX5-ENET/IP Ethernet Module. This flaw allows remote attackers to render the device unresponsive by continuously sending UDP packets, necessitating a system reset for recovery. The vulnerability affects all versions of the FX5-ENET/IP module, posing significant risks to industrial control systems reliant on this equipment. The incident underscores the critical importance of securing industrial control systems against network-based attacks. As similar vulnerabilities continue to emerge, organizations must proactively implement robust network security measures, including firewalls and VPNs, to mitigate potential threats and ensure operational continuity.
6 days ago
Kill Chain
Critical RCE Vulnerability Discovered in PTC Windchill PLM Software
In March 2026, a critical remote code execution (RCE) vulnerability, identified as CVE-2026-4681, was discovered in PTC's Windchill Product Lifecycle Management (PLM) software. This flaw, stemming from improper deserialization of untrusted data, affects multiple versions of Windchill PDMLink and FlexPLM. Exploitation of this vulnerability could allow attackers to execute arbitrary code remotely, potentially compromising sensitive product data and disrupting manufacturing processes. PTC has acknowledged the issue and is actively developing a fix. In the interim, they have provided specific mitigation steps, including updates to Apache and IIS server configurations, to protect affected systems. Organizations utilizing Windchill are urged to implement these workarounds immediately to safeguard their environments. This incident underscores the persistent threat posed by software vulnerabilities in critical infrastructure sectors. The exploitation of deserialization flaws remains a favored technique among cyber adversaries, highlighting the necessity for continuous vigilance, timely patching, and adherence to secure coding practices to mitigate such risks.
3 months ago
Kill Chain
Delta Electronics CNCSoft-G2 2026 Out-of-Bounds Write Vulnerability
In March 2026, Delta Electronics identified a critical vulnerability (CVE-2026-3094) in its CNCSoft-G2 software, specifically an out-of-bounds write issue in the DOPSoft component's DPAX file parsing. This flaw allows attackers to execute arbitrary code if a user opens a maliciously crafted file, potentially compromising system integrity. The vulnerability affects CNCSoft-G2 versions prior to V2.1.0.39. Delta Electronics has released version 2.1.0.39 to address this issue and recommends users update promptly. This incident underscores the persistent risks associated with file parsing vulnerabilities in industrial control systems, emphasizing the need for regular software updates and vigilant cybersecurity practices to protect critical infrastructure.
3 months ago
Kill Chain
Delta Electronics ASDA-Soft Vulnerability Exposes Critical Systems to Risk
In January 2026, Delta Electronics disclosed a critical stack-based buffer overflow vulnerability (CVE-2026-1361) in their ASDA-Soft software, versions up to 7.2.0.0. This flaw allows attackers to write arbitrary data beyond the bounds of a stack-allocated buffer, potentially leading to the corruption of a structured exception handler (SEH). Exploitation requires local access and user interaction, but no prior authentication, posing significant risks to confidentiality, integrity, and availability. Delta Electronics has released version 7.2.2.0 to address this issue. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-1361?utm_source=openai)) This incident underscores the persistent threat of buffer overflow vulnerabilities in industrial control systems, emphasizing the need for rigorous input validation and timely software updates to mitigate potential exploits.
4 months ago
Kill Chain
Active Exploitation of Dassault DELMIA Apriso Vulnerabilities Impacts Manufacturing Sector
In June 2024, CISA issued an alert highlighting active exploitation of two vulnerabilities (CVE-2024-22120 and CVE-2024-22121) within Dassault Systèmes’ DELMIA Apriso platform, a widely used manufacturing operations management solution. The flaws, found in DELMIA Apriso Release 2017 to 2023, allow unauthenticated attackers to execute remote code, potentially compromising production environments and exposing sensitive operational data. Attackers are leveraging these vulnerabilities to target the manufacturing sector for automated ransomware deployment and data exfiltration, resulting in operational disruption and risk to production integrity. This incident underscores the trend of threat actors focusing on supply chain and OT/IT hybrid platforms, exploiting unpatched flaws for initial access. The urgent CISA advisory signals accelerating regulatory scrutiny and highlights the increased risks posed by software supply chain weaknesses in critical infrastructure sectors.
5 months ago
Kill Chain
How BlackSuit Ransomware Hit a Global Equipment Manufacturer in 2024
In early 2024, a global equipment manufacturer experienced a significant ransomware attack carried out by the threat actor Ignoble Scorpius, leveraging the BlackSuit ransomware. The attack began with a sophisticated vishing campaign targeting an employee, leading to credential compromise and lateral movement within the company’s network. Attackers bypassed multiple defenses, ultimately deploying the ransomware to encrypt critical business systems and disrupt operations worldwide. The incident required rapid response, threat intelligence analysis, and comprehensive remediation to restore services and protect sensitive data. This incident highlights the growing danger of human-centric social engineering combined with advanced ransomware—a tactic increasingly adopted by organized threat actors. With the resurgence of targeted and blended attacks, organizations face urgent pressure to strengthen security controls and resilience against such evolving threats.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports