✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Utilities
Breach intelligence, attack campaigns, and threat reports targeting the Utilities sector.
Explore Other Sectors
Utilities Threat Reports
CISA Discloses 2025 ICS Vulnerabilities Affecting Critical Infrastructure
In November 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released five Industrial Control Systems (ICS) Advisories highlighting significant vulnerabilities impacting multiple vendors: Fuji Electric, Survision, Delta Electronics, Radiometrics, and IDIS. These advisories detail newly identified security issues, including unencrypted communication, improper authentication, and exploitable flaws exposing critical industrial and manufacturing systems to potential attack vectors. While no active exploitation has been publicly reported yet, the disclosed vulnerabilities could allow remote attackers to gain unauthorized access, disrupt operations, or compromise sensitive operational technology environments if left unaddressed. This incident underscores the ongoing and urgent need for proactive vulnerability management and timely patching within ICS environments. With an uptick in vulnerability disclosures and the rising convergence of IT and operational technology, threat actors continue to target unpatched systems in critical infrastructure, amplifying regulatory and business risk for operators in energy, manufacturing, and transportation sectors.
6 months ago
Kill Chain
Claroty Authentication Bypass Threatens OT Security in 2025
In early 2025, a critical vulnerability tracked as CVE-2025-54603 was discovered in Claroty’s industrial cybersecurity products, exposing operational technology (OT) networks and critical infrastructure to potential attacks and data theft. The flaw allowed threat actors to bypass authentication mechanisms, granting unauthorized access to sensitive network segments. Attackers leveraging this security gap could disrupt essential services, compromise confidential process data, and pose significant operational and safety risks. Claroty responded by issuing urgent patches to contain the exposure and mitigate ongoing threats. This incident highlights the increasing risk of authentication bypass exploits in OT environments, as threat actors target weak points in security architectures to gain privileged access. The event underscores an urgent need for robust, zero trust security frameworks and rapid vulnerability management in critical infrastructure sectors.
6 months ago
Kill Chain
CISA 2025 ICS Advisories Expose Widespread Industrial Control System Risks
In October 2025, CISA released thirteen industrial control systems (ICS) advisories highlighting critical security vulnerabilities across various products from leading vendors such as Rockwell Automation, Siemens, Hitachi Energy, Schneider Electric, and Delta Electronics. The disclosed vulnerabilities affected solutions commonly used in industrial environments, including HMIs, SCADA software, network management systems, and control processors. These weaknesses, if left unaddressed, could be leveraged by malicious actors for unauthorized access, lateral movement, or disruption of industrial processes, posing significant operational and safety risks to organizations dependent on ICS infrastructure. This mass vulnerability disclosure arrives amid an intensifying regulatory focus on the security of ICS and OT environments, paralleling a broader trend of increased adversary attention to unpatched operational technologies. Organizations must prioritize timely patching and hardened network segmentation to mitigate rapidly evolving threats and prevent cascading impacts across critical infrastructure.
6 months ago
Kill Chain
Siemens 2025: Missing Authentication Flaw in TeleControl Server Threatens Industrial Security
In October 2025, Siemens disclosed a critical authentication vulnerability (CVE-2025-40765) affecting TeleControl Server Basic V3.1 (versions before V3.1.2.3). The flaw, rated CVSS 9.3/10, allows remote, unauthenticated attackers to obtain user password hashes and perform authenticated actions on the database service. The vulnerability exposes critical manufacturing infrastructure worldwide, potentially enabling attackers to manipulate or disrupt automated industrial processes by escalating privileges. Siemens and CISA provided immediate mitigations, including patching and network access controls. This incident highlights the persistent risks from missing authentication controls in OT/ICS applications, at a time when remote exploitation targeting critical infrastructure is rapidly rising. The disclosure underscores the importance of timely patch management and network segmentation for industrial environments facing evolving cyber threats.
6 months ago
Kill Chain
Siemens 2025 ICS Vulnerabilities Expose Critical Manufacturing to Remote Disruption
In October 2025, Siemens disclosed high-severity vulnerabilities in its SIMATIC S7-1200 CPU V1/V2 Devices, a critical component used in manufacturing automation worldwide. Security researchers found that improper input validation and authentication bypass by capture-replay allowed unauthenticated remote attackers to either cause a denial-of-service state or remotely execute recorded engineering commands on exposed controllers, regardless of security passwords. The vulnerabilities, affecting devices shipped globally, could let on-path attackers disrupt operations or halt production lines if exploited. Siemens and CISA issued urgent advisories and released patches to mitigate risks. This incident highlights the ongoing vulnerability of industrial control systems (ICS) to remote exploits and session replay attacks. As critical infrastructure faces increasing threats from both sophisticated threat actors and opportunistic attacks, organizations operating legacy or unpatched automation hardware must rapidly recalibrate their cyber defenses in light of persistent risks and global attack surface expansion.
6 months ago
Kill Chain
Critical Siemens RUGGEDCOM ROS Vulnerabilities Expose Industrial Control Systems in 2025
In October 2025, Siemens disclosed several critical vulnerabilities in its RUGGEDCOM ROS industrial control system devices used globally in critical manufacturing sectors. The flaws include the use of weak cryptographic algorithms, improper handling of exceptional conditions, and protection mechanism failures, making affected devices susceptible to man-in-the-middle attacks, denial-of-service, and potential unauthorized access until device reboot. Exploitation is possible remotely with low complexity, allowing attackers to compromise encrypted communications or persist on non-management interfaces. This incident is especially relevant as supply chains and critical infrastructure increasingly adopt ICS/OT devices that, if not properly secured, expose entire operations to disruption. The persistence of cryptographic weaknesses and the growing sophistication of adversaries underscore the urgent need for robust, up-to-date security controls across the ICS ecosystem.
6 months ago
Kill Chain
Critical DoS Vulnerability in Rockwell Compact GuardLogix 5370 Exposes Manufacturing Operations
In October 2025, Rockwell Automation disclosed a critical remotely exploitable vulnerability (CVE-2025-9124) affecting Compact GuardLogix 5370 industrial controllers, stemming from an uncaught exception flaw. Attackers could trigger a denial-of-service by sending crafted CIP unconnected explicit messages, resulting in a major, non-recoverable device fault. The vulnerability, reported by Rockwell itself, exposes impacted controllers to significant operational disruptions, particularly concerning for organizations within critical manufacturing sectors worldwide. Immediate device upgrades and network segmentation were recommended to mitigate risk. This vulnerability highlights persistent gaps in OT security as attackers increase their focus on industrial control systems. The incident underscores the urgency surrounding real-time vulnerability management and emphasizes the rising threat surface presented by remotely accessible critical infrastructure.
6 months ago
Kill Chain
Critical Vulnerabilities in Rockwell Automation 1783-NATR Threaten Global Industrial Operations
In October 2025, Rockwell Automation disclosed three critical vulnerabilities in its 1783-NATR network address translation devices, primarily affecting industrial environments worldwide. The flaws included missing authentication checks on critical functions, a stored cross-site scripting (XSS) vulnerability, and a cross-site request forgery (CSRF) flaw. Remote attackers could exploit these to compromise administrative accounts, alter device configurations, and disrupt network traffic flow, potentially causing denial-of-service or the exposure of sensitive data vital to manufacturing operations. The vulnerabilities impacted all devices running firmware version 1.006 and earlier, with no public exploitation reported at the time of disclosure. This incident highlights the persistent security risks in operational technology (OT) and industrial control systems, particularly as threat actors increasingly target publicly exposed or poorly segmented infrastructure. The disclosure underscores the need for continuous patch management, robust network segmentation, and diligent monitoring to prevent widespread operational disruptions stemming from remote exploitation of critical vulnerabilities.
6 months ago
Kill Chain
CISA Discloses 2025 ICS Vulnerabilities Impacting Critical Infrastructure
In October 2025, the Cybersecurity and Infrastructure Security Agency (CISA) disclosed 10 advisories detailing significant vulnerabilities found in a range of Industrial Control Systems (ICS) from leading manufacturers including Rockwell Automation, Siemens, Schneider Electric, and others. These advisories highlighted security flaws impacting critical operational technology components—such as PLCs, network devices, and cloud-enabled devices—potentially exposing vital infrastructure to remote code execution, unauthorized access, and disruption risks. Attackers leveraging these weaknesses could impact sectors like energy, manufacturing, and healthcare, posing threats to operational continuity and safety. This incident underscores the escalating threat landscape for operational technology and ICS environments as attackers increasingly target critical infrastructure using both opportunistic exploits and sophisticated attack vectors. The wave of advisories reflects mounting urgency for organizations to prioritize OT security, driven by evolving regulatory requirements and the proliferation of targeted attacks on essential industrial sectors.
6 months ago
Kill Chain
Critical 2025 Raisecomm Authentication Bypass: Root Access Risk to ICS Networks
In October 2025, a critical remote authentication bypass vulnerability (CVE-2025-11534) was publicly disclosed in Raisecomm RAX701-GC series network equipment, allowing unauthenticated attackers to establish SSH sessions and gain root shell access without providing valid credentials. Discovered and reported by security researchers from runZero, this exploit poses an elevated risk to infrastructure sectors relying on these devices globally, as affected firmware versions remain susceptible with exploits achievable at low complexity and no prior privileges. Business and operational impacts include full remote compromise, lateral movement potential, and the ability for attackers to implant persistent threats or disrupt essential communications and IT operations. The incident is especially pressing now, indicating a rising trend in targeting embedded and edge devices in critical environments via misconfigurations or software flaws. As attackers expand their focus to accessible infrastructure, organizations face increasing pressure to implement robust access controls, proactive segmentation, and defense-in-depth strategies to safeguard operational networks.
6 months ago
Kill Chain
CISA Unveils 2025 ICS Vulnerabilities: Critical Risks to Energy & Healthcare
In October 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released eight advisories highlighting multiple critical vulnerabilities in a range of Industrial Control Systems (ICS) products, including solutions from AutomationDirect, ASKI Energy, Veeder-Root, Delta Electronics, NIHON KOHDEN, Schneider Electric, and Hitachi Energy. These vulnerabilities could allow threat actors, including both cybercriminals and nation-state adversaries, to execute remote code, escalate privileges, disrupt control functionality, or access sensitive operational data. Although no confirmed exploits were publicly detailed at the time of disclosure, the affected systems are widely deployed in energy, healthcare, and manufacturing, raising concerns about both operational integrity and national infrastructure risk. The incident underscores an urgent trend of continuous vulnerability discovery within ICS and operational technology environments as attackers increasingly target these sectors. This rising cadence of disclosures highlights both the complexity of securing interconnected systems and the need for ongoing vigilance and layered defense measures in critical infrastructure.
6 months ago
Kill Chain
Veeder-Root TLS4B Vulnerabilities Expose Energy Sector to Remote Attacks in 2025
In October 2025, critical vulnerabilities were disclosed in the Veeder-Root TLS4B Automatic Tank Gauge System, widely deployed across the global energy sector. Security researcher Pedro Umbelino reported a severe command injection flaw (CVE-2025-58428) in the SOAP-based web service, enabling attackers with valid credentials to execute system-level commands, gain shell access, and potentially move laterally within targeted networks. A second vulnerability (CVE-2025-55067) affects time handling, potentially enabling attackers to cause authentication failures and denial of service by exploiting the Unix epoch rollover issue. Both vulnerabilities are remotely exploitable and threaten operational continuity, device functionality, and network integrity. This incident highlights the growing exposure of industrial control systems to sophisticated, remotely exploitable vulnerabilities. With the energy sector’s increasing reliance on interconnected OT devices, attackers are targeting control interfaces and authentication flaws to achieve deeper network access, reinforcing the urgent need for proactive risk assessments and robust segmentation strategies.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports