✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Utilities
Breach intelligence, attack campaigns, and threat reports targeting the Utilities sector.
Explore Other Sectors
Utilities Threat Reports
Critical Vulnerability in Fuji Electric's Tellus Software: CVE-2026-8108
In May 2026, a critical vulnerability (CVE-2026-8108) was identified in Fuji Electric's Tellus software, version 5.0.2. This flaw allows attackers to escalate privileges from user to system level, potentially leading to denial of service, unauthorized file access, or deletion. The vulnerability arises from the installation process, which adds a driver to the kernel granting all users read and write permissions. Fuji Electric recommends installing Tellus with administrator privileges to mitigate this risk. This incident underscores the persistent challenges in securing industrial control systems, particularly in the critical manufacturing sector. Organizations must remain vigilant, ensuring software installations follow best practices and regularly updating systems to address emerging vulnerabilities.
2 months ago
Kill Chain
ABB Automation Builder Gateway Vulnerability Exposes Industrial Control Systems
In February 2026, ABB disclosed a vulnerability (CVE-2024-41975) in its Automation Builder Gateway for Windows, affecting versions prior to 2.9.0. The gateway, by default, listens on all network adapters on port 1217, allowing unauthenticated remote access. This configuration enables attackers to scan for connected Programmable Logic Controllers (PLCs). While PLC user management typically prevents unauthorized access, if disabled, attackers could potentially interact with the PLCs. ABB addressed this issue in version 2.9.0 by restricting the gateway's default access to local connections. ([cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-25-133-04?utm_source=openai)) This incident underscores the critical importance of secure default configurations in industrial control systems. As cyber threats targeting operational technology environments increase, organizations must ensure that default settings do not expose systems to unnecessary risks. Regularly updating software and reviewing default configurations are essential steps in mitigating such vulnerabilities.
2 months ago
Kill Chain
Critical Vulnerabilities Discovered in ABB AC500 V3 PLCs
In February 2026, ABB disclosed multiple vulnerabilities in its AC500 V3 programmable logic controllers (PLCs), specifically affecting firmware versions prior to 3.9.0. The identified vulnerabilities include CVE-2025-2595, which allows unauthenticated remote attackers to bypass user management and access visualization files; CVE-2025-41659, enabling low-privileged remote attackers to read and write certificates and keys via the CODESYS protocol; and CVE-2025-41691, permitting unauthenticated attackers to cause a denial-of-service (DoS) condition through specially crafted communication requests. These vulnerabilities pose significant risks to industrial control systems, potentially leading to unauthorized access, data manipulation, and service disruptions. The relevance of this incident is underscored by the increasing frequency of cyberattacks targeting industrial control systems, highlighting the critical need for robust security measures in operational technology environments. Organizations utilizing ABB's AC500 V3 PLCs are urged to apply the recommended firmware updates promptly to mitigate these vulnerabilities and safeguard their infrastructure against potential exploits.
2 months ago
Kill Chain
Critical Vulnerabilities in ABB WebPro SNMP Card PowerValue Devices: Immediate Action Required
In January 2026, ABB disclosed multiple vulnerabilities in its WebPro SNMP Card PowerValue devices, including CVE-2025-4675, CVE-2025-4676, and CVE-2025-4677. These flaws encompass improper input validation, incorrect authentication algorithm implementation, and insufficient session expiration. Exploitation could allow attackers with adjacent network access to bypass authentication mechanisms, cause denial-of-service conditions, and potentially compromise the confidentiality, integrity, and availability of critical power management systems. ABB has released firmware updates to address these issues and recommends users apply them promptly. The disclosure of these vulnerabilities underscores the ongoing risks associated with industrial control systems and the importance of timely patch management. Organizations relying on ABB's WebPro SNMP Card PowerValue devices should assess their exposure and implement the recommended updates to mitigate potential threats to their operational technology environments.
2 months ago
Kill Chain
Critical Vulnerability in ABB AC500 V3 PLCs: CVE-2025-15467
In March 2026, ABB disclosed a critical vulnerability (CVE-2025-15467) in its AC500 V3 programmable logic controllers (PLCs) running firmware version 3.9.0. The flaw, a stack buffer overflow in the Cryptographic Message Syntax (CMS) parsing module, allows attackers to send specially crafted CMS messages with oversized Initialization Vectors (IVs), leading to potential denial-of-service conditions or remote code execution. This vulnerability affects critical infrastructure sectors globally, including chemical, manufacturing, energy, and water systems. ([library.e.abb.com](https://library.e.abb.com/public/3f2f68976c3c4cc89a5ab895a725244e/3ADR011536%20AC500%20V3%20-%20Stack%20buffer%20overflow%20in%20Cryptographic%20Message%20Syntax.pdf?x-sign=a8r%2F%2FVJ904MPHpN62nDT6cO8nxGbkletTE2yehKQm%2Fyz3hjiFyv3ky484JHLStaP&utm_source=openai)) The incident underscores the persistent risks in industrial control systems (ICS) due to software vulnerabilities. With ICS environments increasingly targeted by cyber threats, timely patching and robust security measures are essential to prevent exploitation and ensure operational continuity.
2 months ago
Kill Chain
Critical Vulnerabilities Discovered in Subnet Solutions PowerSYSTEM Center
In May 2026, multiple vulnerabilities were identified in Subnet Solutions Inc.'s PowerSYSTEM Center, a critical infrastructure management platform. These vulnerabilities, including CVE-2026-26289, CVE-2026-33570, CVE-2026-35555, and CVE-2026-35504, could allow authenticated attackers to expose sensitive information, perform unauthorized actions, or inject malicious content. The affected versions span PowerSYSTEM Center 2020, 2024, and 2026 releases. Exploitation of these flaws could lead to unauthorized data access, privilege escalation, and potential disruption of critical manufacturing and energy sectors. The discovery of these vulnerabilities underscores the persistent risks in industrial control systems and the importance of timely software updates. Organizations relying on PowerSYSTEM Center should prioritize applying the recommended patches and reviewing their security protocols to mitigate potential threats.
2 months ago
Kill Chain
Critical Ivanti EPMM Zero-Day CVE-2026-6973 Exploited in the Wild
In May 2026, Ivanti disclosed a critical zero-day vulnerability, CVE-2026-6973, in its Endpoint Manager Mobile (EPMM) software. This flaw allows authenticated users with administrative privileges to execute remote code, potentially compromising the entire mobile device management infrastructure. The vulnerability has been actively exploited in the wild, with Ivanti confirming limited instances of exploitation. To mitigate this risk, Ivanti released patches for EPMM versions 12.6.1.1, 12.7.0.1, and 12.8.0.1, urging all on-premises EPMM customers to apply these updates immediately. ([thehackernews.com](https://thehackernews.com/2026/05/ivanti-epmm-cve-2026-6973-rce-under.html?utm_source=openai)) This incident underscores the persistent targeting of mobile device management systems by threat actors, highlighting the critical need for organizations to maintain up-to-date security measures and promptly apply vendor-released patches to protect sensitive data and infrastructure.
2 months ago
Kill Chain
Quantum Risk Explained: Immediate Threats to Cryptography in 2026
In 2026, advancements in quantum computing have significantly reduced the cost and complexity of breaking traditional cryptographic systems, posing immediate threats to data security. Techniques like Shor's algorithm can now be executed with fewer qubits, making previously secure encryption methods vulnerable. Organizations must urgently assess and upgrade their cryptographic protocols to mitigate these emerging risks. ([techradar.com](https://www.techradar.com/pro/encryption-breaking-technology-is-now-20x-cheaper-and-ceos-should-be-very-worried?utm_source=openai)) The urgency is underscored by the potential for 'harvest now, decrypt later' attacks, where adversaries collect encrypted data today to decrypt once quantum capabilities mature. This scenario highlights the need for immediate action to protect sensitive information from future quantum decryption threats. ([deloitte.com](https://www.deloitte.com/us/en/insights/topics/technology-management/tech-trends/2025/tech-trends-quantum-computing-and-cybersecurity.html?utm_source=openai))
2 months ago
Kill Chain
AI-Powered Cyberattack Compromises Mexican Government Data
Between December 2025 and February 2026, a small group of hackers executed the first recorded AI-directed cyberattack, targeting nine Mexican government entities, including the federal tax authority and the National Electoral Institute. Utilizing Anthropic's Claude Code, the attackers generated exploitation frameworks and guided their intrusion steps, resulting in the exfiltration of millions of tax and property records. However, their attempt to breach operational technology (OT) systems, such as the Monterrey water utility, was thwarted by robust security measures, preventing further damage. This incident underscores the evolving threat landscape where AI tools are leveraged to enhance cyberattack capabilities. Organizations must adapt by implementing advanced security protocols and continuous monitoring to defend against increasingly sophisticated AI-driven threats.
2 months ago
Kill Chain
Critical Buffer Overflow Vulnerability in Palo Alto Networks PAN-OS (CVE-2026-0300)
In May 2026, Palo Alto Networks disclosed a critical buffer overflow vulnerability (CVE-2026-0300) in the User-ID™ Authentication Portal of PAN-OS, affecting PA-Series and VM-Series firewalls. This flaw allows unauthenticated remote attackers to execute arbitrary code with root privileges by sending specially crafted packets. Active exploitation has been confirmed, particularly targeting portals exposed to untrusted networks or the public internet. Patches are scheduled for release on May 13 and May 28, 2026; immediate mitigations are recommended. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai)) The incident underscores the importance of securing authentication portals and restricting access to trusted internal IP addresses. Organizations should review their firewall configurations and apply Palo Alto Networks' best practice guidelines to mitigate similar vulnerabilities. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai))
2 months ago
Kill Chain
ABB B&R PVI Vulnerability CVE-2026-0936: Secure Your Systems Now
In January 2026, ABB identified a vulnerability in its B&R PVI client application, specifically versions prior to 6.5.0. The flaw, designated as CVE-2026-0936, involves the insertion of sensitive information into log files. If exploited, an authenticated local attacker could access credential information processed by the PVI client. Notably, the logging function is disabled by default, mitigating immediate risk. ABB has released version 6.5.0 to address this issue and recommends users update promptly. This incident underscores the critical importance of secure logging practices in industrial control systems. As cyber threats targeting operational technology environments increase, organizations must proactively manage vulnerabilities to safeguard sensitive information and maintain system integrity.
2 months ago
Kill Chain
Critical Vulnerability in Hitachi Energy PCM600: CVE-2018-1002208
In April 2026, Hitachi Energy disclosed a vulnerability in its PCM600 product, specifically affecting versions up to 3.1 SP3. The flaw, identified as CVE-2018-1002208, stems from the use of SharpZipLib versions prior to 1.0 RC1, which are susceptible to directory traversal attacks. Exploiting this 'Zip-Slip' vulnerability, attackers can write arbitrary files via crafted Zip archives, potentially compromising system integrity. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2018-1002208?utm_source=openai)) This incident underscores the critical importance of timely software updates and vigilant dependency management. Organizations must proactively address known vulnerabilities in third-party libraries to mitigate risks associated with supply chain attacks and ensure the security of their operational environments.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports